I need help with my props conf to extract fields correctly.

djreschke — Wed, 15 Sep 2021 15:53:53 GMT

When I test the regex in both regex101 and using the rex command in the search bar and they parsed out the fields correctly. Now that i have added them to the props conf on the search head, they are capturing extra information.

The Result field is the one that is mainly caputuring the SessionID which the the capture is Verified or Failed.

Thank you all for your help with this.

props.conf

[exp_test]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
CHECK_FOR_HEADER = false
CHARSET = AUTO

EXTRACT-SessionID = (?<=SessionID:)(?P<SessionID>.+)
EXTRACT-Result = \VerificationResult:(?P<Result>.+)
EXTRACT-UserName = (?<=User:)(?P<UserName>.+)
EXTRACT-Response_1 = (?<=Response_1:)(?P<Response_1>.+)
EXTRACT-Response_2 = (?<=Response_2:)(?P<Response_1>.+)

Sample Log

Time: 13-09-2021 10:08:19
VerificationResult: Failed
SessionID: K3K2N2G3JPSOZNOWJFOMFPBP.pidd1v-210913090809460797217
User: LAST, FIRST
13-09-2021 10:10:18 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:10:19 Response_1: 1st response received! for User: LAST, FIRST
Time: 13-09-2021 10:10:19
SessionID and User Mapping:
SessionID: 3EV6PLCHK795Z8FQBKKYS3Z3.pidd2v-210913091018537820706
User: LAST, FIRST
13-09-2021 10:15:13 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:15:14 Response_1: 1st response received! for User: LAST, FIRST
Time: 13-09-2021 10:15:14
SessionID and User Mapping:
SessionID: GAWJ1C7ZWNAWCVTEEIWGE3LL.pidd2v-210913091513558630064
User: LAST, FIRST
13-09-2021 10:15:33 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:15:33 Response_1: 1st response received! for User: LAST, FIRST
13-09-2021 10:15:38 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:15:39 Response_1: 1st response received! for User: LAST, FIRST
Time: 13-09-2021 10:15:39
SessionID and User Mapping:
SessionID: 2SYZV3QHCZKYM2YTYIJLVL3E.pidd2v-210913091538460803649
User: LAST, FIRST
13-09-2021 10:15:47 Response_1: 2nd request sent! for the user verification SessionID: 2SYZV3QHCZKYM2YTYIJLVL3E.pidd2v-210913091538460803649
13-09-2021 10:15:48 Response_1: 2nd response received! for user verification SessionID: 2SYZV3QHCZKYM2YTYIJLVL3E.pidd2v-210913091538460803649
Time: 13-09-2021 10:15:48
VerificationResult: Verified
SessionID: 2SYZV3QHCZKYM2YTYIJLVL3E.pidd2v-210913091538460803649
User: LAST, FIRST
13-09-2021 10:16:47 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:16:48 Response_1: 1st response received! for User: LAST, FIRST
Time: 13-09-2021 10:16:48
SessionID and User Mapping:
SessionID: D5JVVUR3AAKFURITHCI993H9.pidd2v-210913091647448944771
User: LAST, FIRST

Re: I need help with my props conf to extract fields correctly.

richgalloway — Wed, 15 Sep 2021 19:26:55 GMT

What is the extra information that is extracted.

The \ in EXTRACT-Result is not needed.

Consider using \w+ or \S+ instead of .+.

topic Re: I need help with my props conf to extract fields correctly. in Splunk Search

I need help with my props conf to extract fields correctly.

Re: I need help with my props conf to extract fields correctly.