props.conf fixed value using EXTRACT

jmsiegma — Mon, 28 Sep 2020 14:26:44 GMT

I would like to take the following lines in my props.conf file, and at Search Time, use these Field Extractions to Set a fixed value for a new field depending on the rule that it hits:

[safenet_datasecure]
EXTRACT-datasecure0 = Web login failure\: Invalid username\/password in login attempt for administrator \"(?<ing_user>[a-zA-Z0-9]+)\" from (?<ing_clientip>[0-9]+.[0-9]+.[0-9]+.[0-9]+)
EXTRACT-datasecure1 = Login attempted with invalid username \"(?<ing_user>[a-zA-Z0-9]+)\"

So I get a field like ing_rule=0 or ing__rule=1 depending on if it used datasecure0 or datasecure1 to extract the field from the event.

Anyone?

Re: props.conf fixed value using EXTRACT

martin_mueller — Sat, 27 Jul 2013 08:03:19 GMT

In this specific case, ing_rule would be 0 if there is an ing_clientip field - you can use that in an eval or calculated field.

As a more general approach, you could extract different ing_user1, ing_user2, ... fields and assign ing_rule depending on which field is filled and after that merge them into one ing_user field.

topic props.conf fixed value using EXTRACT in Splunk Search

props.conf fixed value using EXTRACT

Re: props.conf fixed value using EXTRACT