topic Re: Trouble creating a new field in Splunk Search

Trouble creating a new field

gforster — Tue, 06 Jun 2017 14:19:21 GMT

2017-06-06 08:30:56,761 [ajp-127.0.0.4-8009-44] INFO  Weblogger  - 3B08FDCAF216658E81536A07B9D5772E: cdbarnes: reset randomusername LDAP password. ticket: 3121467

Given the above line from a log, I need to have a field for "randomusername." The goal would then be to plot it on a timechart so that it can readily be discerned how many times a given user changes their password within a timeframe. I'm not sure of the best approach to isolate the username and make it its own field to begin with.

thanks

Re: Trouble creating a new field

adonio — Tue, 06 Jun 2017 15:47:57 GMT

use the field extractor
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX
hope it helps

Re: Trouble creating a new field

niketn — Tue, 06 Jun 2017 15:51:41 GMT

You can begin using rex command, one example is below

<Your Base Search>
| rex field=_raw "reset (?<UserName>.+) LDAP password"
| table UserName _raw

However, you should ideally perform the same using Interactive Field Extraction (IFX) through the Extract New Fields option through your Splunk Search screen. Refer to the documentation for Step By Step process. Two advantages would be
1) Splunk will generate/adjust regular expression based on your data/needs
2) Fields will persist as Knowledge Object hence can be reused.
3) You can override with your own regular expression.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX