topic Re: How do i capture login ID as the same field across two differently-formatted logs? in Splunk Search

How do i capture login ID as the same field across two differently-formatted logs?

a212830 — Wed, 20 Nov 2013 02:43:16 GMT

Hi,

Looking for ideas on how to attack a problem...

I have a couple of different systems (servers and vpn's) and I need to show login id's that have been used on both. I have the login message for both systems, but the format is different. How do I capture the login id across both feeds, using the same field?

For example:

message 1: User1 logged in...
message 2: mm/dd/yyy system abc - User1 logged in

I want to run a search to grab the "user" and map it to one field, across both feeds?

Re: How do i capture login ID as the same field across two differently-formatted logs?

ShaneNewman — Wed, 20 Nov 2013 02:50:17 GMT

You can use the rex command if you want to do it in the search bar. If not, you can move the regex to the props.conf and transforms.conf to make it automatic.

 your search | rex "(?<user_id>\w+)\slogged\sin"

This regex will work for both cases, assuming that the user id's are [A-Za-Z0-9_]. If other characters can be expected you will have to account for that by changing the \w+ to [\w(your other chars)]+

Re: How do i capture login ID as the same field across two differently-formatted logs?

lukejadamec — Mon, 28 Sep 2020 15:19:16 GMT

your search | rex field=_raw "(?\w+)\slogged\sin"

Re: How do i capture login ID as the same field across two differently-formatted logs?

ShaneNewman — Wed, 20 Nov 2013 03:25:14 GMT

field=_raw is implied if you don't specify it. Although, I do put it in all of mine, just for good practice.

Re: How do i capture login ID as the same field across two differently-formatted logs?

kristian_kolb — Wed, 20 Nov 2013 09:52:54 GMT

To make the extractions more permanent;

props.conf
[server_sourcetype]
EXTRACT-srv_login = (?<userID>\w+)\slogged\sin

[vpn_sourcetype]
EXTRACT-vpn_login = (?<userID>\w+)\slogged\sin

Re: How do i capture login ID as the same field across two differently-formatted logs?

a212830 — Wed, 20 Nov 2013 13:04:16 GMT

Thanks everyone. I did a bad job on the examples. My login id is in the format d123450. However, that could be anywhere in the event. How would I grab that, since it could be anywhere, and, more importantly, how do I look for that id across two different searches?

Re: How do i capture login ID as the same field across two differently-formatted logs?

somesoni2 — Wed, 20 Nov 2013 16:23:53 GMT

Then can you provide more examples? a complete _raw values would be great.

Re: How do i capture login ID as the same field across two differently-formatted logs?

somesoni2 — Wed, 20 Nov 2013 16:30:00 GMT

If the format of your userid is X123456 (start with character and then bunch of digits), following regex should be able to extract userid from any place within the string.

| rex field=_raw "(?<userId>[a-zA-Z][0-9][^ ]+)"

Re: How do i capture login ID as the same field across two differently-formatted logs?

kristian_kolb — Mon, 25 Nov 2013 09:23:39 GMT

But you run the risk of getting some other useless info this way. With a pattern so unspecific, you basically need to anchor the regex to some known surrounding string.