All Apps and Add-ons

How to extract multiple fields at a time from Eloquence fwaudit logs?

jameslitt
New Member

Hello

I'm attempting to extract multiple fields at a time from eloquence db fwaudit logs, an example of which is below:

timestamp: 2016-12-08 12:04:38
  ORDER-NO              : +XXXX
  CUST-NO               : X
 -CC-DOLLARS            : XXX
 +CC-DOLLARS            : XXX
  CREDIT-CARD-NO        : "X"
  CC-EXPIRE-DATE        : "X"
  ORDER-DATE            : +XXXXXX
  BILLING-TYPE          : "X"
  BILL-ISSUE-NO         : "\000\000"
  POSTED-DATE           : +XXXXXX
  POSTED-TIME           : +XXXXXX
  BILL-DATE             : +XXXXX

I have tried field extraction through the Splunk Web wizards, both the regular expression and delimiters options. But the problem with that is you have to define the fields, where as with this there are multiple fields at a time (I'd want to extract whatever fields have "+" and "-" at the beginning) and the fields themselves can vary from log to log.

I have installed Splunk Common Information Model (CIM) hoping that may help but no luck, there is also no existing eloquence app which I hoped would help with field extraction.

Any suggestions I can work from? Thanks

0 Karma

gokadroid
Motivator

If you want to catch the fields having values starting with +/- try this if you only want to list them:

your query to return the events
| rex field=_raw max_match=0 "(?<field_name>[\S]+)\s*?\:\s*?(?<field_value>(\+|\-)[\S]+)"
| table field_name, field_value

If you want then to be separate fields try something ike this:

your query to return the events
| rex field=_raw max_match=0 "(?<field_name>[\S]+)\s*?\:\s*?(?<field_value>(\+|\-)[\S]+)"
| eval myFields=mvzip(field_name, field_value, "~")
| mvexpand myFields
| rex field=myFields "(?<myFieldName>[^\~]+)~(?<myFieldValue>.*)"
| table myFieldName, myFieldValue

If you want to search on any of the above fields then you can use | search myFieldName="stringValue" or somethign like |search myFieldValue="stringValue". For example if you want to search all the fieldNames starting with a +/- like -CC-DOLLARS or +CC-DOLLARS then you can try to append this right at then:

| search myFieldName="\+*" OR myFieldName="\-*"

0 Karma

jameslitt
New Member

Hi, thanks for your reply! I am getting some results back for this, however not everything I would like.

To clarify I'm looking for only the results on the left hand side with a "+" or "-", essentially the field names rather than the field results.

Would you be able to help further please? I'm completely new to regular expression and its all going over my head. Are there any resources on regex you would recommend I look at?

Thanks again

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...