topic Regex field extraction in Splunk Search

Regex field extraction

gonzalogasca — Thu, 13 Nov 2014 15:23:58 GMT

Splunk Version 6.2.0
Splunk Build 237341 (MacOSX Yosemite)

This is the line I'm looking to extract fields using regex:

15:23:42.730 |LogMessage UserID : jdoe ClientAddress : 172.16.60.54 Severity : 3 EventType : UserLogging ResourceAccessed: Cisco CallManager Administration EventStatus : Failure CompulsoryEvent : No AuditCategory : AdministrativeEvent ComponentID : Cisco CCM Application AuditDetails : Failed to Log into Cisco CCM Webpages App ID: Cisco Tomcat Cluster ID: Node ID: UCM-CLI-P

I'm looking to extract:
jdoe
172.16.60.54

I have tested my regex using:
http://www.regexr.com/39t8f
In regexr the information is :

/UserID\s:\s(.*)\s+ClientAddress\s:\s(\d+.\d+.\d+.\d+)\s+\s+(.*)/g

It correctly maps (.*) and (\d+.\d+.\d+.\d+) as group 1 and group 2.

I tested it using Perl:

if ($line
=~m/.*UserID\s:\s(.*)\s+ClientAddress\s:\s(.*)\s+Severity\s:\s+(\d).*/i) {
        print " Username: " . $1 . " ClientAddress: " . $2 .  "\n";         }

And I can correctly get my fields in $1 and $2.

When I execute this search in Splunk:

Failed to Log into Cisco CCM Webpages | rex field=_raw "UserID\s:\s(?.*)\s+ClientAddress\s:\s(?\d+.\d+.\d+.\d+)\s+"

The USERIDINFORMATION and CLIENTADDRESS fields are not extracted. It can find the records because of the left part of the search, but not on my regex.
Any ideas?

Re: Regex field extraction

Ayn — Thu, 13 Nov 2014 15:38:23 GMT

I don't see you actually giving your matching groups names? You need to give them names:

rex field=_raw "UserID\s:\s(?<USERIDINFORMATION>.*)\s+ClientAddress\s:\s(?<CLIENTADDRESS>\d+.\d+.\d+.\d+)\s+"

Re: Regex field extraction

gonzalogasca — Thu, 13 Nov 2014 19:25:42 GMT

For some reason the HTML Formatting was not adding my fields

Re: Regex field extraction

landen99 — Fri, 17 Jul 2015 12:33:09 GMT

The capture fields do need names, but also the regex needs to be good. Anything with ".*" is generally troublesome. You should extract the fields with two seperate regexes for efficiency:

(?i)UserID\s+:\s+(?P<user>\w+)
(?i)ClientAddress\s+:\s+(?P<src>[\.\d]+)

This can be pasted straight into the Field Extractions section of splunk or be set at the commandline:

| rex "(?i)UserID\s+:\s+(?P<user>\w+)" | rex "(?i)ClientAddress\s+:\s+(?P<src>[\.\d]+)"