Information extraction

klaudiac — Wed, 26 Jan 2022 14:04:01 GMT

Hi folks,

Hoping you might be able to help.

I've some raw logs coming in and one of the "extracted" fields is a fields with all the system information I need e.g.

Remote Desktop Protocol: OS: Windows 10/Windows Server OS Build: 10.0.18362 Target Name: NACORP NetBIOS Domain Name: NACORP NetBIOS Computer Name: 1234ABC DNS Domain Name: na.corp.xxxxx.com System Time: 2021-12-12 22:55:40.534959 Authorized Use Only - v 041001 This system is for the use of authorized users only.

How do I extract specific pieces from it? I need NetBIOS Domain Name and Computer Name and System Time

I thought of using a regex but not sure how to build it since NetBIOS Domain Name values can be of different variations e'g one will be NACORP another one will be USON and another wil be NACORP.LOCAL

Similar with the computer name - there's no unified naming convention - it depends on a country we get the logs from. some can have a "-" in the middle, some will have a "." etc.

Any hints and tips on how to tackle it will be more than appreciated!

Re: Information extraction

gcusello — Wed, 26 Jan 2022 14:17:23 GMT

Hi @klaudiac,

please try something like this:

| rex field=extracted_field "NetBIOS\s+Domain\s+Name:\s+(?<NetBIOS_Domains_Name>.*)\s+NetBIOS\s+Computer\s+Name:\s+(?<NetBIOS_Computer_Name>.*)\s+DNS.*System\s+Time:\s+(?<System_Time>.*)\s+Authorized"

that you can test at https://regex101.com/r/ZiS0ey/1

Ciao.

Giuseppe

topic Information extraction in Splunk Search

Information extraction

Re: Information extraction