All Apps and Add-ons

Complex regex help

jlixfeld
Path Finder

I've tried a few tools to try and write the proper regex syntax to do what I want, but I'm not having any luck.

I have syslog output that comes from two different device types that comes out with different fields whether it's one device type or the other:

Oct  5 09:02:40 10.219.49.2 66772: bfr01.151front711 RP/0/RSP0/CPU0:Oct  5 09:02:40.861 : exec[65706]: %SECURITY-login-6-AUTHEN_SUCCESS : Successfully authenticated user 'rancid' from '10.219.51.130' on 'vty0'
Oct  5 08:12:29 10.219.49.31 146074: bpe01.77mowat506: Oct  5 08:12:28.623: %LINK-3-UPDOWN: Interface Virtual-Access45, changed state to down

The important fields are the hostname which appears in field 6 in both lines and as Cisco calls it "%message-group-severity-message-code" which appears in two different fields depending on the device.

Using the field extrator, I can generate a regex that captures the hostname:

"(?:[^:\n]*:){6}\s+(?P<FIELDNAME1>[^ ]+)"

But I can't figure out how to get field extractor to also capture the %message as a different field. Heck, I can't even get it to reliably match %message in the first place. It doesn't seem to understand when I enter copy and paste different values from two different fields and ask it to match against it.

I'd be grateful of for any assistance.

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Try:

^(?:\S*\s*){5}(?<hostname>\S*)[^%]*(?<message>%\S+)

It could be more precise (e.g., it could define where after the hostname the message occurs, instead of just finding the first %), but should work.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Try:

^(?:\S*\s*){5}(?<hostname>\S*)[^%]*(?<message>%\S+)

It could be more precise (e.g., it could define where after the hostname the message occurs, instead of just finding the first %), but should work.

jlixfeld
Path Finder

Hi Oliver,

You are partially right. I perhaps didn't make my question clear enough. I apologize. I'd like to match %message as well as hostname. I understand that the field extractor can extract multiple fields at once.

0 Karma

jlixfeld
Path Finder

Again, my apologies. The hostname in the example would be either bfr01.151front711 or bpe01.77mowat506.

I tried your second regex, and that works much better, except for one small issue. It matches this as one field:

bfr01.151front711 RP/0/RSP0/CPU0

The one field should only be:

bfr01.151front711

0 Karma

OL
Communicator

Sorry, I'm not sure that I can recognize the hostnames from the log but I'm guessing you want to get "bfr01.151front711 RP/0/RSP0/CPU0" and "bpe01.77mowat506", but would this one be OK:

[^ ]+ [^ ]+ [^ ]+ [0-9]+: (?[^:]+).*: (?%[^:]+):

0 Karma

OL
Communicator

Hello,

From your email I understand that you are trying to collect "%SECURITY-login-6-AUTHEN_SUCCESS" and "%LINK-3-UPDOWN". This is the correct, have you tried this regex:

: (?<FIELDNAME1>%[^:]+):

Hope this help.

Regards,
Olivier

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...