topic Re: Field Extraction - Trim Existing Field in Splunk Search

Field Extraction - Trim Existing Field

jchampagne — Mon, 28 Sep 2020 12:11:17 GMT

In some of our event logs, the client IP address is recorded with leading information (::ffff:). I would like to trim this data and create a new field, which I can then do a reverse dns lookup on using a scripted lookup.

I'm not looking to modify the index, I'd like all of this to happen at search time.
The field I'm looking to modify is called Client_Address and a sample value would be:
::ffff:192.168.207.88

If I use the following REX at search time, I get a new field called Client_IP that looks good:
rex field=Client_Address "(?\b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b)"

However, I'd like to use props.conf so this all happens automatically. If I add the following line to my WinEventLog:Security stanza, it doesn't work.

EXTRACT-ClientIP = rex field=Client_Address "(?\b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b)"

Re: Field Extraction - Trim Existing Field

MHibbin — Thu, 02 Aug 2012 19:27:26 GMT

Firstly you don't need the rex part that is a search command.

You should look at the props.conf spec file.

Try something like

EXTRACT-ClientIP = [:,f]*(?<ip>\d+\.\d+\.\d+\.\d+)

EXTRACT-ClientIP = [:,f]*(?<ip>\d{1,3}\.\{1,3}\.\d{1,3}\.\d{1,3})

Or you can just use the Interactive Field Extractor to help with the config of the props.conf (if you do the regex in IFX and save it, it will do the file itself.

Re: Field Extraction - Trim Existing Field

jchampagne — Thu, 02 Aug 2012 19:34:09 GMT

Thanks for the help!
I ended up using the following line, which seems to work.

EXTRACT-ClientIP = (?\b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b)

Re: Field Extraction - Trim Existing Field

MHibbin — Thu, 02 Aug 2012 19:37:04 GMT

no worries... what's with the "b" in your regex?