How to extract token from HTTP header?

miberecz — Fri, 13 May 2022 16:14:00 GMT

Hello Everyone,

I have a set of data with a lot of HTTP requests, where I want to extract only the tokens highlighted below.

header=Authorization=Basic MmQyXXXXXXXXNDVjOTlkNTJlM2M0ZjA1MzVjYTI4ZGZkMzJmNTBlMjk=

2022-05-13 10:07:07,772 INFO [io.undertow.request.dump] (default task-13778) ----------------------------REQUEST--------------------------- URI=/auth/realms/Public/protocol/openid-connect/token characterEncoding=null contentLength=29 contentType=[application/x-www-form-urlencoded;charset=UTF-8] header=Accept=application/json, application/x-www-form-urlencoded header=Cache-Control=no-cache header=Pragma=no-cache header=User-Agent=Java/11.0.4 header=Connection=keep-alive header=Authorization=Basic MmQyXXXXXNDVjOTlkNTJlM2M0ZjA1MzVjYTI4ZGZkMzJmNTBlMjk= header=Content-Type=application/x-www-form-urlencoded;charset=UTF-8 header=Content-Length=29

I tried with the Field Extractor wizard, but with no luck.

Can you please advise, how to achieve this?

Re: Extract token from HTTP header

ITWhisperer — Fri, 13 May 2022 09:06:57 GMT

Try something like this

| rex "header=Authorization=Basic\s(?<auth>\S*)"

topic How to extract token from HTTP header? in Splunk Search

How to extract token from HTTP header?

Re: Extract token from HTTP header