topic Re: Why is my rex command extracting other text strings in Splunk Search

Why is my rex command extracting other text strings

jhilton90 — Mon, 07 Nov 2022 12:10:04 GMT

I am using the following rex command to extract an id number, which is in the following format: 1e4gd5g7-4fy6-fg567-3d46-3gth63f57h35. I am also using the rex command to extract email addresses. However, it seems to extract the wrong information, let me show you:

index=keycloak "MFA" | regex _raw="MFA challenge failed" | rex "(?i) is (?P<keycloak_id>[^\"]+)" | rex "(?i) is (?P<email_address>.+?)\.\s+" | table Account_ID, email_address, keycloak_id, _time

However, this is the output that I get:

Account_ID	email_address	keycloak_id	_time
aaaaaaa	'OTP is invalid'	'OTP is invalid'. Keycloak session id is 1e4gd5g7-4fy6-fg567-3d46-3gth63f57h35	2022-11-07 09:56:17.00

I'm really struggling to properly extract the right information that I'm looking for.

Any help would be greatly appreciated

Re: Why is my rex command extracting other text strings

gcusello — Mon, 07 Nov 2022 12:44:45 GMT

Hi @jhilton90,

could you share some sample of your data?

Ciao.

Giuseppe

Re: Why is my rex command extracting other text strings

ITWhisperer — Mon, 07 Nov 2022 12:49:34 GMT

You have a flimsy anchor - for example, " is " occurs multiple times in your event. You need to provide more context to the anchor so the right place can be found in your events.

Re: Why is my rex command extracting other text strings

jhilton90 — Mon, 07 Nov 2022 13:38:31 GMT

The keycloak_id and email_address are in the same field. Basically the field goes like this:

message: MFA challenge succeeded for account aaaaaa with email example@example.com. Keycloak session id is 44t4tegr-44fg-4444-4444-444444444444

Re: Why is my rex command extracting other text strings

jhilton90 — Mon, 07 Nov 2022 13:47:40 GMT

The keycloak_id and email_address are in the same field. Basically the field goes like this:

message: MFA challenge succeeded for account aaaaaa with email example@example.com. Keycloak session id is 44t4tegr-44fg-4444-4444-444444444444

Re: Why is my rex command extracting other text strings

gcusello — Mon, 07 Nov 2022 13:59:20 GMT

Hi @jhilton90,

please try this

| rex "account\s+(?<account>\w+)\s+with\s+email\s+(?<email>[^ ]+)"

that you can test at https://regex101.com/r/6zSc2W/1

Ciao.

Giuseppe

Re: Why is my rex command extracting other text strings

ITWhisperer — Mon, 07 Nov 2022 14:08:57 GMT

Try something like this

Re: Why is my rex command extracting other text strings

jhilton90 — Mon, 07 Nov 2022 14:15:02 GMT

Let me give it a go! Great resource by the way, thank you