topic Re: How to extract Time and User from events using regex? in Splunk Search

How to extract Time and User from events using regex?

uayub — Tue, 01 Jul 2014 18:04:52 GMT

The following events are filtered by Snare and sent to Splunk from Windows Servers:

Server.egcorp.com MSWinEventLog 1 Security 255931 Tue Jul 01 02:56:52 2014 528 Security JOHN User Success Audit Server Logon/Logoff Successful Logon: User Name: JOHN Domain: egcorp Logon ID: (0x0,0xC8BCFD2) Logon Type: 2 Logon Process: User32 Authentication Package: Negotiate Workstation Name: Server Logon GUID: {122ff468-2a7e-bd13-abfc-3dbf4c3ac3d4} Caller User Name: Server$ Caller Domain: egcorp Caller Logon ID: (0x0,0x3E7) Caller Process ID: 532 Transited Services: - Source Network Address: 127.0.0.1 Source Port: 0 255930

Objective: To extract the Time and the User from these events using regex to filter these two fields.
Result:
Jul 01 02:56:52 2014 JOHN

Thanks

Re: How to extract Time and User from events using regex?

richgalloway — Tue, 01 Jul 2014 18:09:05 GMT

Is that a single event you cited or multiple events?

Re: How to extract Time and User from events using regex?

uayub — Tue, 01 Jul 2014 18:12:25 GMT

Multiple events

Re: How to extract Time and User from events using regex?

Richfez — Tue, 01 Jul 2014 18:27:20 GMT

Does the time stamp Splunk has found match your time string in the data? If so, can you use that for your time?

Re: How to extract Time and User from events using regex?

richgalloway — Tue, 01 Jul 2014 18:31:27 GMT

If that's multiple events then you'll have trouble using just regex to get your fields. I see a date only in the first event and a user name only in the second (twice). To parse these, you'll first need to combine them using a common field.

Re: How to extract Time and User from events using regex?

uayub — Tue, 01 Jul 2014 18:31:43 GMT

The time stamps of Splunk and the event might not be the same.

Re: How to extract Time and User from events using regex?

uayub — Tue, 01 Jul 2014 18:33:49 GMT

RICHGALLOWAY - Sorry I misunderstood your question. The event that I listed above is in-fact just one event. But splunk receives multiple such events.

Re: How to extract Time and User from events using regex?

richgalloway — Tue, 01 Jul 2014 18:57:58 GMT

This regex string should do the trick.

(?:[\S]+ ){6}(?<DateTime>\S+\s\S+\s\d+:\d+:\d+\s\d{4})[\s\S]*?Name:\s(?<User>\S+)\s

Full Query

(server02 OR server01) AND 528 | rex "(?:[\S]+ ){6}(?<DateTime>\S+\s\S+\s\d+:\d+:\d+\s\d{4})[\s\S]*?Name:\s(?<User>\S+)\s" | table DateTime User

Re: How to extract Time and User from events using regex?

uayub — Tue, 01 Jul 2014 19:13:45 GMT

I tried:
* (server02 OR server01) AND 528 | rex "(?:[\S]+ ){6}(?\S+\s\S+\s\d+:\d+:\d+\s\d{4})[\s\S]*?Name:\s(?\S+)\s"

and I just go the raw events:

Re: How to extract Time and User from events using regex?

somesoni2 — Tue, 01 Jul 2014 19:15:09 GMT

Add this after the search. "| table DateTime, User"

Re: How to extract Time and User from events using regex?

uayub — Tue, 01 Jul 2014 19:33:00 GMT

After applying this , the EVENTS shows the entire raw events but the STATISTICS shows no results.. am I missing something ...

Re: How to extract Time and User from events using regex?

richgalloway — Tue, 01 Jul 2014 19:36:20 GMT

Remember that Splunk is case sensitive. The field names in the stats and table commands must match those in your rex string exactly.

Re: How to extract Time and User from events using regex?

uayub — Tue, 01 Jul 2014 19:39:11 GMT

(server02 OR server01) AND 528 | rex "(?:[\S]+ ){6}(?\S+\s\S+\s\d+:\d+:\d+\s\d{4})[\s\S]*?Name:\s(?\S+)\s" | Table DateTime, User

It looks correct to me.. perfect matching case too

Re: How to extract Time and User from events using regex?

richgalloway — Tue, 01 Jul 2014 19:46:28 GMT

Look closer. 'datetime' <> 'DateTime'; 'user' <> 'User'

Re: How to extract Time and User from events using regex?

uayub — Tue, 01 Jul 2014 20:55:43 GMT

(server02 OR server01) AND 528 | rex "(?:[\S]+ ){6}(?\S+\s\S+\s\d+:\d+:\d+\s\d{4})[\s\S]*?Name:\s(?\S+)\s" | table DateTime User

In the Search all look correct. Only when I paste it in the Splunk Community page it comes different. Still no results are shown. I think the regex is not matching any user in the events.

Re: How to extract Time and User from events using regex?

richgalloway — Wed, 02 Jul 2014 12:23:13 GMT

I've never known these boards to change text like that. Perhaps putting backticks around the pasted text will help.
Does adding a '*' to the table command show any fields have been parsed?

Re: How to extract Time and User from events using regex?

uayub — Thu, 03 Jul 2014 21:12:17 GMT

After adding the "*", it shows all fields including DateTime and User - but these fields are blank. The rest of the fields have valid data.