topic Re: User Name field extraction - Strip DOMAIN in username in Splunk Search

User Name field extraction - Strip DOMAIN in username

pjohnson1 — Tue, 20 Oct 2015 07:08:28 GMT

I have a field extraction which extracts the User Name. Some users will authenticate with their user name, but some will also pre-fix it by the domain.

How can I strip out the domain in the field extraction if the user includes the domain to authenticate?

username=john.doe
username=domain\john.doe

I referred to this https://answers.splunk.com/answers/172242/how-to-use-rex-to-remove-the-domain-from-the-user.html , but the extraction will only extract those user names pre-fixed by domain.

Thanks.

Re: User Name field extraction - Strip DOMAIN in username

MuS — Tue, 20 Oct 2015 09:15:28 GMT

Hi pjohnson1,

try this crazy regex

your base search here | rex "(?:=(?!\w+\\)|(?<!=)\\)(?<user>\S+)" | ...

This will search for a = not followed by a word character and a \ or a \ not leaded by a = and takes in any non whitespace character as field user - tested and working on http://regex101.com and you will get a better explanation there as well 🙂

Hope this helps ...

cheers, MuS

Re: User Name field extraction - Strip DOMAIN in username

pjohnson1 — Tue, 20 Oct 2015 11:54:41 GMT

Hi MuS,

Thanks for the comment.

I tried:

tag=authentication eventtype="aruba-user-authenticated" | rex "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"

But it matches

username=john.doe

but fails

username=domain\john.doe

Re: User Name field extraction - Strip DOMAIN in username

woodcock — Tue, 20 Oct 2015 13:41:00 GMT

Like this:

... | rex field=username mode=sed "s/[^\\]*[\\]//"

Re: User Name field extraction - Strip DOMAIN in username

southeringtonp — Tue, 20 Oct 2015 13:46:00 GMT

You can modify your field extraction logic pull out both the user and domain, and allow the domain to be skipped if not present.

The sample below will extract three fields. username will contain the full results, user_domain will contain "domain" in second example above, and will be blank for the first. user will contain john.doe for both examples you gave.

Put the following into your transforms.conf:

[user-with-domain]
REGEX = username=((?:([^\\]+)\\)?(\S+))
FORMAT = username:$1 user_domain::$2 user::$3

And activate it via props.conf:

  [mysourcetype]
  REPORT-user = user-with-domain

Re: User Name field extraction - Strip DOMAIN in username

MuS — Tue, 20 Oct 2015 20:42:02 GMT

Sorry my bad, just add max_match=0 to the regex and it will match everything:

 tag=authentication eventtype="aruba-user-authenticated" | rex max_match=0 "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"

Re: User Name field extraction - Strip DOMAIN in username

MuS — Tue, 20 Oct 2015 20:43:19 GMT

this will work as run everywhere search:

| gentimes start=-1 | eval foo="
username=john.doe
username=domain\john.doe
username=other_domain\foo.baz" | rex max_match=0 field=foo "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"  | table user

Re: User Name field extraction - Strip DOMAIN in username

andresito123 — Tue, 29 Sep 2020 09:39:14 GMT

I have tried this workaround but it seems that it doesn't work all the time.

I have 4 sourcetypes (for Sophos Endpoint logs) and I have created this configuration for all of them at the same files (local folder of Splunk_TA_sophos app).

It seems that it works for the three of them and not for the forth. Any ideas why this is happens?

Thanks!