topic Rex extraction specific example in Splunk Search

Rex extraction specific example

cburr2012 — Mon, 06 Aug 2012 15:54:18 GMT

Hello Splunkers,

Problem: Splunk query returns events where "Account_Name" appears twice, thus returning multiple/inaccurate Account Name results.

Solution: I want to rex grab the second instance of Account_Name. Here is an example of output:

Message=An account was successfully logged on.

Subject:
Security ID:        S-1-0-0

Account Name:       -
Account Domain:     -
Logon ID:       0x0

Logon Type:         3

New Logon:
Security ID:        S-1-5-21-1616162011-3457912633-3195248547-20163

Account Name:       johndoe

Account Domain:     THISDOMAIN
Logon ID:       stuff_here
Logon GUID:     {00000000-0000-0000-0000-000000000000}

In this situation, I want to grab "johndoe". I am not sure how to skip all of the lines in between the first Account Name and the second, then precede to pull "johndoe".

Thanks for your answers and help in advance.

Re: Rex extraction specific example

hexx — Mon, 06 Aug 2012 16:16:54 GMT

You have a couple of options.

One is to use a multi-line regular expression and define a capture group targeted at the second occurrence of "Account Name:".

... | rex "(?ms)Account Name:.*?Account Name:\s+(?<account_name>\S+)"

A different, perhaps more flexible way is to define a negative lookahead that will cause the regular expression not to match when "Account Name:" is followed by a hyphen.

... | rex "Account Name:\s+(?!-)(?<account_name>\S+)"

Re: Rex extraction specific example

cburr2012 — Mon, 06 Aug 2012 16:20:32 GMT

Perfect, hexx.

Follow-up Question: Do you know of a good source for Splunk rexing? I don't have much experience with traditional regexing and am not familiar with the difference between the two, if any.

Re: Rex extraction specific example

hexx — Mon, 06 Aug 2012 16:23:41 GMT

I am not sure what you mean by "Splunk rexing", but if what you are curious about is the flavor of regular expressions that Splunk uses, I can tell you that it's PCRE. If you want to know more about the syntax of the "rex" command and see examples, I would suggest to check this topic in the Search reference manual.

Re: Rex extraction specific example

cburr2012 — Mon, 06 Aug 2012 16:27:45 GMT

Yes, the flavor 🙂 Thanks again.

Re: Rex extraction specific example

tiny3001 — Mon, 19 Nov 2012 08:26:47 GMT

I know this has been answered long ago, but I'm surprised that no one has mentioned eval and mvindex yet. With a multi-value field, you can use mvindex to target the first, second (or third or fourth, etc.) value of a field with the same name.

... 
| eval subject_account=mvindex(Account_Name, 0) 
| eval target_account=mvindex(Account_Name, 1) 
| where target_account = "some_account"

Some events also have an empty target account, in which case you can write an if statement into your eval. See this answer for an example.

http://splunk-base.splunk.com/answers/48096/account_name-field-listing-in-events-4624-4768-and-4769-windows-2008

For cases like Account_Name, I find the mvindex to be much easier to use than regular expressions.