topic Re: Can you help me with a field extraction using REGEX? in Splunk Search

Can you help me with a field extraction using REGEX?

rohitvjoshi — Mon, 28 Jan 2019 07:31:37 GMT

Hi all,

I am getting an event in the below format:

 28/01/2019
    07:20:54.000    
 USERNAME           FROM             LATEST
Test1            10.0.0.1          Jan 25 15:42:07 2018
admin          10.0.1.31        Jan 15 14:11:26 2019
osadmin      10.0.10.12     Jan 23 16:38:12 2019
awa              10.13.5.21     Oct 1 14:15:16 2018

I am trying to extract USERNAME , FROM ,LATEST as a field using field extraction method. I tried the REGEX for Username like this :
^(?P\w+\s+), but when I am running the field extraction , it is giving me the Results "USERNAME" only .

Please help me to extract USERNAME,FROM,LATEST from the event via field extraction.

Thanks

Rohit

Re: Can you help me with a field extraction using REGEX?

chrisyounger — Mon, 28 Jan 2019 07:47:31 GMT

Is each line a different event? When you are trying to get regex's correct, you can test them directly in the search like this:

<your search> | rex "^\s*(?<a_username>\S+)\s+(?<a_from>\S+)\s+(?<a_latest>.+)

Then you should see your fields extracted. if they aren't correct, adjust the rex as required.

Re: Can you help me with a field extraction using REGEX?

mayurr98 — Mon, 28 Jan 2019 10:10:03 GMT

hi can you try this:

index=your_index | rex field=_raw "(?<username>\w+)\s(?<from>\d{1,2}\.\d{1,2}\.\d{1,2}\.\d{1,2})\s(?<latest>.+)"

if there are multiple usernames in 1 event then you need to add max_match=0 in rex command.

let me know if this helps!

Re: Can you help me with a field extraction using REGEX?

rohitvjoshi — Mon, 28 Jan 2019 11:31:16 GMT

No Luck 😞

Re: Can you help me with a field extraction using REGEX?

rohitvjoshi — Mon, 28 Jan 2019 11:32:26 GMT

No , this is Single event which gives me the information about the users who logged in into UNIX Servers.

Re: Can you help me with a field extraction using REGEX?

mayurr98 — Mon, 28 Jan 2019 11:35:01 GMT

can you paste your entire event in 101010 sample code as it looks like in splunk.

Re: Can you help me with a field extraction using REGEX?

chrisyounger — Mon, 28 Jan 2019 11:47:08 GMT

Try this then:

<your search> | multikv noheader=t | rex "^\s*(?<a_username>\S+)\s+(?<a_from>\S+)\s+(?<a_latest>.+)

Re: Can you help me with a field extraction using REGEX?

rutdesanti — Mon, 28 Jan 2019 17:00:24 GMT

Try this one:

>  | rex "^(?P<myfield>\w\s\w\s\w)"

Re: Can you help me with a field extraction using REGEX?

rohitvjoshi — Tue, 29 Jan 2019 06:58:44 GMT

Thanks ,It workes 🙂