topic Help with fields extraction in Splunk Search

Help with fields extraction

numeroinconnu12 — Fri, 29 Apr 2022 15:55:30 GMT

Good evening,
Thank you all for your support,
I have a field called Memberof which contains the following data per line.

1) cn=GRP_Basic,ou=Users,dc=admin,dc=spike|cn=GRP_Hash,ou=Groups,dc=admin,dc=spike

2) cn=GRP_ADC,ou=Groups,dc=admin,dc=spike|cn=GRP_Vabd_Admin,dc=admin,dc=spike|cn=GRP_Vabd_Supe

3) cn=GRP_sos,ou=Groups,dc=command,dc=spike

I wanted to extract for each row all that starts with GRP

For example for the first line I need to extract GRP_Basic and GRP_Hash
For the second line I have to extract GRP_ADC and GRP_Vabd_Admin and GRP_Vabd_Supe

thank you very much

Re: fields extraction

ITWhisperer — Thu, 28 Apr 2022 22:52:03 GMT

| rex max_match=0 "(?<grp>GRP_[^,]+)"

Re: fields extraction

numeroinconnu12 — Fri, 29 Apr 2022 06:34:17 GMT

Hello,

Thank you very much for the answer but it doesn't work.
I would like to extract only GRP_Basic or GRP_Hash

thank you

Re: fields extraction

gcusello — Fri, 29 Apr 2022 06:38:48 GMT

Hi @numeroinconnu12,

you have two choices:

use the regex from @ITWhisperer and filter results for the two values you want after the rex command using the search command,
insert the condition about the two values in the regex.

about the second please try this:

| rex max_match=0 "(?<grp>GRP_Basic|GRC_Hash)"

Ciao.

Giuseppe

Re: fields extraction

gcusello — Tue, 14 Jun 2022 09:45:13 GMT

Hi @numeroinconnu12,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉