topic Help with Field Extraction in Splunk Search

Help with Field Extraction

secphilomath1 — Fri, 26 Jan 2024 19:45:57 GMT

Here is my sample data;

start=Dec 30 2023 06:07:47 duser=NT AUTHORITY\SYSTEM dvc=10.163.142.37

I need to extract the full duser information. Splunk only grabs NT and not the remaining of the string

I have the following Regex via regex101 that works....I am grabbing whatever is between 'duser=' and ' dvc'

(?<=duser=)(.*?)(?= dvc)

I just don't quite understand how the field extraction part is supposed to work...

I have tried...

| rex field=_raw "'(?<User>(?<=duser=)(.*?)(?= dvc))'"

and

| rex field=_raw "duser=\s+(?<User>[^\\]*)"

No errors, just not getting any data in a User field.

Thanks in advance.

Re: Help with Field Extraction

ITWhisperer — Fri, 26 Jan 2024 19:53:20 GMT

Set your anchors either side of the field extraction

| rex "duser=(?<User>.*?) dvc"

Re: Help with Field Extraction

secphilomath1 — Fri, 26 Jan 2024 21:26:26 GMT

When I put in my search like this

| rex field=_raw "duser=(?<User>.*?) dvc"

I get a new field called UserNameLabel with the value of User

Re: Help with Field Extraction

secphilomath1 — Fri, 26 Jan 2024 23:03:53 GMT

When I put in my search like this

| rex field=_raw "duser=(?<User>.*?) dvc"

I get a new field called UserNameLabel with the value of 'User' not the user field data

Re: Help with Field Extraction

ITWhisperer — Sat, 27 Jan 2024 09:55:58 GMT

Please share some anonymised sample data. the search you are using, your current results and your expected results

Re: Help with Field Extraction

secphilomath1 — Mon, 29 Jan 2024 17:19:05 GMT

duser=NT AUTHORITY\SYSTEM dvc=10.10.10.10 rt=Jan 29 2024 04:41:24 dhost=abcd.efgh.com SHA-1=Not available MD5=Not available Size=Not available content=0x00000001 (1) contentLabel=Current Version Content timezone=Pacific Standard Time

I want to be able to pull out the duser, dvc, dhost etc. Focusing on the duser ATM because it is giving me the most grief because of the space in the value. If I can get one to work, I can get the rest working.

The search so far is simple;

index="abc"

| rex field=_raw "duser=(?P<User>.*?) dvc"

| table User

Re: Help with Field Extraction

ITWhisperer — Mon, 29 Jan 2024 18:17:02 GMT

| rex "duser=(?<duser>.*?) dvc=(?<dvc>\S+).*dhost=(?<dhost>\S+)"

Re: Help with Field Extraction

secphilomath1 — Mon, 29 Jan 2024 18:20:13 GMT

Wow, thanks so much! That solves all my problems!

Re: Help with Field Extraction

secphilomath1 — Mon, 29 Jan 2024 18:58:46 GMT

Oh wait these have to be in order, what if I wanted to grab a field that is 10 fields before this.

Expanded Sample Data;

dvchost=asdf.ghi.com NodeType=Windows Server NodeTypeLabel=Node Type Rule=Critical System Settings RuleLabel=Rule RuleType=Windows Registry Rule RuleTypeLabel=Rule Type fname=HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoWebServices ChangeType=Added ChangeTypeLabel=Change Type SeverityName=High SeverityNameLabel=Tripwire Severity Name VersionOID=-1y2p0ij32e8cf:-1y2p0iizs0ilf VersionOIDLabel=Version OID SeverityNumber=10000 SeverityNumberLabel=Tripwire Severity Number sproc=C:\Windows\System32\svchost.exe licurl=https://abcd.ghi.com/console/lic.search.cmd?lic=true&managerId=nodeManager&pageId=nodeManager.elementFinderPage&searchCriteria=%7B%22search.element.nodeGroup.selectedObject%22%3A%22-1y2p0ij32e8bm%3A-1y2p0ij02lp4k%22%2C%22search.element.name.op%22%3A1%2C%22search.element.name%22%3A%22HKEY_LOCAL_MACHINE%5C%5CSoftware%5C%5CMicrosoft%5C%5CWindows%5C%5CCurrentVersion%5C%5CPolicies%5C%5CExplorer|NoWebServices%22%2C%22selectedSearchType%22%3A%22element%22%2C%22search.element.ruleGroup.selectedObject%22%3A%22-1y2p0ij32e7p1%3A-1y2p0ij32bgh0%22%2C%22criteria.searchExecuted%22%3Atrue%7D start=Jan 07 2024 06:07:45 duser=NT AUTHORITY\SYSTEM dvc=10.10.10.10 rt=Jan 29 2024 04:41:24 dhost=abcd.ghi.com SHA-1=Not available MD5=Not available Size=Not available content=0x00000001 (1) contentLabel=Current Version Content timezone=Pacific Standard Time timezoneLabel=Time Zone elementOID=-1y2p0ij32e8ca:-1y2p0ij02lo5f elementOIDLabel=Element OID blVersion=false blVersionLabel=Is baseline version hardCodedIP=10.10.10.10

Say I wanted the fields NodeType, RuleType, fname, duser, sproc?

Thanks

Re: Help with Field Extraction

ITWhisperer — Mon, 29 Jan 2024 22:59:55 GMT

As I said in my original reply, you just have to set up the anchors correctly. regex101.com is a great site for testing regex.