topic Re: How do you extract multiple strings of text using rex? in Splunk Search

How do you extract multiple strings of text using rex?

TechnicalRS — Mon, 02 Jun 2014 17:06:07 GMT

I have VPN access connect/disconnect events from a Meraki security appliance being fed into Splunk. They show up in Splunk as:

Jun  2 11:13:37 10.0.0.253 1
1401722017.518634469 Site1_Firewall events client_vpn_connect user id 'username@domainname.com' local ip
192.168.111.165 connected from 10.2.30.44

Jun  2 11:10:02 10.0.0.253 1
1401721802.723896809 Site1_Firewall events client_vpn_disconnect user id 'username@domainname.com' local ip
192.168.111.165 connected from 10.2.30.44

I am needing this data to be less cluttered for a report that shows when users are accessing the VPN, and would only really need something like:

Jun 2 11:10:02 connect username@domainname.com 10.2.30.44
Jun 2 11:13:55 disconnect username@domainname.com 10.2.30.44

What would be the best method of extracting only the needed information from the logged message? I have read up on the rex command in splunk and while it seems like this would be where I need to be looking, I have absolutely no experience with how to write regular expressions. If anyone can offer a suggestion on how to accomplish this (as well as tips/reading material for understanding and writing regular expressions!) I would be very appreciative

Re: How do you extract multiple strings of text using rex?

somesoni2 — Mon, 02 Jun 2014 17:36:25 GMT

Try something like this.

Your base search | rex "client_vpn_(?<Action>[^ ]*) user id '(?<UserId>[^']*)'" | rex " connected from (?<IPAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval Message=strftime(_time,"%B %d %H:%M:%S")." ".Action." ".UserId." ".IPAddress | table Message

Re: How do you extract multiple strings of text using rex?

TechnicalRS — Mon, 02 Jun 2014 18:17:39 GMT

That works perfectly. Thank you very much!

Re: How do you extract multiple strings of text using rex?

somesoni2 — Mon, 02 Jun 2014 18:22:36 GMT

And here are some regex cheatsheet for reference.

http://wiki.splunk.com/images/2/2b/Cheatsheet.pdf
http://krijnhoetmer.nl/stuff/regex/cheat-sheet/