topic Extra data in Splunk Search

Extra data

btheneghan — Thu, 29 Aug 2024 00:36:47 GMT

I have never been one to understand regex, however I need to extract everything after the first entry (#172...) into it's own field. Let's call it manual_entry. I'm getting tired of searching and randomly trying things.

#1724872356 exit
#1724872357 exit
#1724872463 cat .bashrc
#1724872485 sudo cat /etc/profile.d/join-timestamp-history.sh
#1724872512 exit
#1724877740 firefox

manual_entry

exit
exit
cat .bashrc
sudo cat /etc/profile.d/join-timestamp-history.sh
exit
firefox

Re: Extra data

richgalloway — Thu, 29 Aug 2024 00:08:51 GMT

There's probably more than one way to do that. If you want to use rex then this should do it. It just takes everything after the first space as the manual_entry field.

| rex "\s(?<manual_entry>.*)"

Re: Extra data

gcusello — Thu, 29 Aug 2024 06:59:48 GMT

Hi @btheneghan ,

if you already extracted the field manual_entry and the format is always the one you descripted in your samples, you could use this regex:

| rex field=manual_entry "^\#\d+\s(?<manual_entry>.*)"

if you didn't extracted the field manual_entry and the format is always the one you descripted in your samples, you could use:

| rex "^\#\d+\s(?<manual_entry>.*)"

Ciao.

Giuseppe