topic Re: RegEx field extraction help in Splunk Search

RegEx field extraction help

pdgill314 — Mon, 20 May 2013 14:29:40 GMT

I have this raw data:

May 20 09:11:09 172.16.20.111 May 20 2013 09:11:09: %ASA-4-113019: Group = AC-Users, Username = <Unknown>, IP = 10.20.50.67, Session disconnected. Session Type: AnyConnect-Parent, Duration: 0h:05m:03s, Bytes xmt: 0, Bytes rcv: 0, Reason: User Requested

But when I attempt to extract out: or 10.20.50.67 or 0h:05m:03s, it does not appear in the list of identified fields. I think it has something to do with the equals sign. Most the time the contains a user's ID.

I tried like this:
(?i)\-Parent, (?P<AC-Users_Duration>[^,]+)

Any help is appreciated.

Re: RegEx field extraction help

martin_mueller — Mon, 20 May 2013 15:22:09 GMT

You should be able to grab them like this:

Username = (?<username>[^,]+)
IP = (?<ip>[^,]+)
Duration: (?<duration>[^,]+)

Re: RegEx field extraction help

pdgill314 — Mon, 20 May 2013 15:33:57 GMT

I tried with Duration, but it does not work, does not even show up.

The Username and IP it tries to classify them as a similar extracted field:

EXTRACT-Portal_User (?i) User <(?P<Portal_User>[^>]+)

EXTRACT-Portal_IP : (?i) IP <(?P<Portal_IP>[^>]+)

Does it have anything to do with the hyphen in the extraction field name?

Tried with this:
(?i)\-Users, Username = (?P<AnyConnectVPN_Users>[^,]+)

And it produced a proper but also a lot of blank lines on the table

Re: RegEx field extraction help

kristian_kolb — Mon, 20 May 2013 15:45:51 GMT

That regex does not add up with the sample logs you provided in your question.

So as martin_mueller so nicely described them - put this in your props.conf:

[your sourcetype] EXTRACT-user = Username\s+=\s+(?<user>[^,]+) EXTRACT-duration = Duration:\s+(?<dur>[^,]+)

Hope this helps,

Re: RegEx field extraction help

pdgill314 — Mon, 20 May 2013 15:51:42 GMT

I think I got it. Thanks martin_mueller

Re: RegEx field extraction help

alexl1 — Mon, 20 May 2013 18:34:19 GMT

how do you guys get the brackets and backslashes to show up in splunk base?

Re: RegEx field extraction help

martin_mueller — Mon, 20 May 2013 20:29:04 GMT

Put four spaces in front of the line to get it to show as-is in a grey box like in my answer. Within a line, you can escape characters with a single backslash in front of them.