Field extraction from checkpoint log with two hostname values

dieguiariel — Mon, 30 Nov 2020 19:09:54 GMT

Hi! im traying to extract a field named hostname from checkpoint logs, but i couldn't with the wizards:

sample:

time=1606760596|hostname=CHKHOST|product=Mobile Access|action=Log In|ifdir=inbound|loguid={0x5fc53894,0x0,0x250a000a,0x2e9b}|origin=10.0.X.X|originsicname=CN\=FW01,O\=CHKHOST.localdomain|sequencenum=293|time=1606760596|version=5|auth_encryption_methods=AES-256 + SHA1 + Group 2|auth_method=RADIUS|client_build=986100611|client_name=Endpoint Security VPN|client_version=E81.10|cvpn_category=Session|device_identification={85FAD095-E5AB-43BA-AA8C-B205F783226E}|domain_name=localdomain|event_type=Login|failed_login_factor_num=0|host_ip=192.168.X.X|host_type=PC|hostname=NB-0237|lastupdatetime=1606760596|login_option=Standard|login_timestamp=1606760596|mac_address=40:5b:d8:64:5b:29|methods:=3DES + SHA1|office_mode_ip=10.193.0.89|os_bits=64bit|os_build=18363|os_edition=Enterprise|os_name=Windows|os_version=10|proto=6|proxy_src_ip=0.0.0.0|s_port=0|service=443|session_timeout=43200|session_uid={5FC53894-0000-0000-0A00-0A259B2E0000}|src=181.121.X.X|status=Success|suppressed_logs=0|tunnel_protocol=IPSec|user=agimenez|user_dn=agimenez|user_group=VPN_Group|

if you see there are two hostname fields, one with the checkpoint hostname and the other with the device connecting to the vpn. I need the second value.

In smart mode or verbose mode, splunk only detects the first hostname field.

How can i parse the second field? Ive tried field extraction wizard with regular expression only selecting the second hostname and i get this error:

The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.

When i try using delimieters, selecting pipe, i get this error:

has exceeded the configured depth_limit, consider raising the value in limits.conf.

any help would be appreciated.

Re: Field extraction from checkpoint log with two hostname values

richgalloway — Mon, 30 Nov 2020 19:27:31 GMT

Try using rex.

... | rex max_match=2 "hostname=(?<hostname>[^\|]+)" | eval hostname=mvindex(hostname,1) ...

Re: Field extraction from checkpoint log with two hostname values

dieguiariel — Mon, 30 Nov 2020 19:56:09 GMT

Thank you!!! it works perfectly!

topic Field extraction from checkpoint log with two hostname values in Splunk Search

Field extraction from checkpoint log with two hostname values

Re: Field extraction from checkpoint log with two hostname values

Re: Field extraction from checkpoint log with two hostname values