topic Re: instr in Splunk ? in Splunk Search

instr in Splunk ?

kp_pl — Thu, 27 Jun 2024 07:03:49 GMT

Below is one of my fields. Quite complex, I know It could be divided to more atomic values .. but it is not 😞

[AuditingPipelinePair, AuditingPipelinePair_response, AuditResponse, RESPONSE] [[
Tag = AUDIT-SUCCESS
Subject = "TAR_ID":"72503", "YEAR":"2106", "EQ_TY":"STD"
BXB ServiceTus TransactionId = sb-W10nXQte_ORf6PjJ4wQ#000000004
Message ID = afa9613.62eeaf42.N6b.1405404bdw7.N7e14
Service Ref = KlmSpsDictanaryS1/proxy/KlmSpsDictanary
Operation = getShareEquip
Protocol = KTTP
Client Address = 11.232.189.10
TransportDevel User = <anonymous>
MessageDevel User = dkd
Message Pode = 0
Payload = Dipis sb-W10wXDte_ORf6PjJde34wQ0004
]]

Anyway, some of (single Strings) values splunk separated automatically like Protocol or Operation. But how to extract (or even eval in query) parameter with space like "MessageDevel User" or "ClientAddress" ?

Re: instr in Splunk ?

ITWhisperer — Thu, 27 Jun 2024 07:23:06 GMT

You could use rex, something like this

| rex "MessageDevel User = (?<MessageDevelUser>\S+)"

Re: instr in Splunk ?

glc_slash_it — Thu, 27 Jun 2024 07:24:26 GMT

Not quite sure what you're asking but, there are several things you can do there:

If fields like "Client Address" are not extracted, you can do a rex command and then use the extracted fields in evals etc:

| rex "Client Address = (?<address>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})" | eval address = ...

If they are already extracted, but the field as a space you can do either:

| rename "Client Address" as ClientAddress |eval ClientAddress = ... or | eval "Client Address" = ...

Re: instr in Splunk ?

kp_pl — Thu, 27 Jun 2024 08:52:05 GMT

I feel it could be a good solution but how to use it ? Should I extract new field with this regex ?

Re: instr in Splunk ?

kp_pl — Thu, 27 Jun 2024 08:54:14 GMT

ok, got it ! Works perfect 🙂

Re: instr in Splunk ?

kp_pl — Thu, 27 Jun 2024 08:58:33 GMT

Would you look at Payload parameter. Result has many strings with spaces.