topic Re: regex is working in cisco asa add-on but get error if the same regex is used in UI with regex command in Splunk Search

regex is working in cisco asa add-on but get error if the same regex is used in UI with regex command

net1993 — Mon, 31 Aug 2020 13:46:16 GMT

Hello

I have the following regex from cisco asa add-on default transforms.conf:

[cisco_source_ipv4]
REGEX = \s+(?:from|for|src(?! user)) (?:(\S+):)[\w-]*?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})(?:\/(\w+))?(?:$(?:([\S^\\]+)\$?([\w\-_]+)\))?\s*$?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})?\/?(\d+)?$?\s*(?:$(?:([\S^\\]+)\$?([\w\-_]+)\))?
FORMAT = src_zone::$1 src_ip::$2 src_port::$3 src_nt_domain::$4 src_user::$5 src_translated_ip::$6 src_translated_port::$7 src_nt_domain::$8 src_user::$9

The issue is that If I try to run the regex from UI, I get error :
Error in 'SearchOperator:regex': The regex '\s+(?:from|for|src(?! user)) (?:(\S+):)[\w-]*?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})(?:\/(\w+))?(?:$(?:([\S^\]+)$?([\w\-_]+)\))?\s*$?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})?\/?(\d+)?$?\s*(?:$(?:([\S^\]+)$?([\w\-_]+)\))?' is invalid. Regex: missing closing parenthesis.

The add-on is working fine as well as search time field extraction so obviously the regex is working fine from transforms.conf but not in UI using regex command.

Someone can help?

Re: regex is working in cisco asa add-on but get error if the same regex is used in UI with regex command

ITWhisperer — Mon, 31 Aug 2020 15:19:53 GMT

According to regex101.com, there are two incomplete capture groups. Adding a couple of parentheses solves this but I am not sure if they are in the right place for what you are trying to extract

| regex "\s+(?:from|for|src(?! user)) (?:(\S+):)[\w-]*?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})(?:\/(\w+))?(?:$(?:([\S^\]+)$?([\w\-_]+)\))?)\s*$?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})?\/?(\d+)?$?\s*(?:$(?:([\S^\]+)$?([\w\-_]+)\))?)"

Re: regex is working in cisco asa add-on but get error if the same regex is used in UI with regex command

net1993 — Tue, 01 Sep 2020 06:44:39 GMT

Which regex do you see errors for ? The first one or the one I have paste from the error? Because I noticed now that this one from the error is slightly different from the original and if I paste it in regex101 , then yes, there is error but as far as I see there is no error in the original regex if pasted in regex101, isn't that correct?

Its strange why splunk has changes on the regex by itself , I guess this is where the error is coming from . Maybe these escaping char makes some bad things ?