topic Re: How to extract a field from the text in Splunk Search

How to extract a field from the text

Hema_Nithya — Sat, 02 Dec 2023 14:42:36 GMT

Dec 2 09:02:17 server1 sudo: ib12345 : TTY=pts/0 ; PWD=/home/ib12345 ; USER=root ; COMMAND=/bin/su -

I need to extract ib12345 from the above data .

Re: How to extract a field from the text

ITWhisperer — Sat, 02 Dec 2023 15:24:34 GMT

This string appears twice, which one do you want to extract - in order for rex to find the right string, you need to define the pattern of characters around (either before, after or both) - unless you always want ib12345, in which case, this should work

| rex "(?<field>ib12345)"

Re: How to extract a field from the text

Hema_Nithya — Sat, 02 Dec 2023 15:28:17 GMT

sudo: ib12345

Value ib12345 will change not constant . It is upi .

Re: How to extract a field from the text

ITWhisperer — Sat, 02 Dec 2023 15:31:03 GMT

Assuming your spacing in your example is consistent with your events, then this should work

| rex "sudo:\s(?<field>\S+)\s"

Re: How to extract a field from the text

gcusello — Sat, 02 Dec 2023 15:34:29 GMT

Hi @Hema_Nithya ,

please try this:

! rex "sudo:\s+(?<field>[^ ]+)"

that you can test at https://regex101.com/r/uBkpRh/1

Ciao.

Giuseppe