topic REGEX help .. I am still learning .... in Splunk Search

REGEX help .. I am still learning ....

Stephen11 — Sun, 30 Aug 2020 22:20:01 GMT

To all:

Still learning about REGEX ... I looked at RUBULAR.COM and REFEX101.com to figure out how to pull out the Users ids... In the example below need to get 4 User Ids out ... I matched on single quote ' - however not able to get the 4 ids in one swoop ... any suggestions? Its just not that easy...

Watched a couple of Youtubes on regex ... just not that all intuitive when condition are a little bit more tricky. appreciate any help I can get.

Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx

Re: REGEX help .. I am still learning ....

thambisetty — Mon, 31 Aug 2020 05:02:46 GMT

Can you share sample event?

the example you shared is not clear.

Re: REGEX help .. I am still learning ....

isoutamo — Mon, 31 Aug 2020 06:43:44 GMT

With your example this seems to work.

index=_internal | head 1 | eval _raw = "Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx" | rename COMMENT AS "previous set example data, next do the regex" | rex max_match=0 "Last usernames used in login requests are:\s(?<NamesAll>[^\.]+)" | rex max_match=0 field=NamesAll "([',\s\.])+(?<Names>[^']+)"

r. Ismo