All Apps and Add-ons

Palo Alto TA user field extraction issue

jwalzerpitt
Motivator

Having an issue with trying to drop a prefix before the username field in the Palo Alto app. The username has the prefix of 'foo\' before the user name. I checked the props.conf file in the app to see the following stanza:

# Set user field
EVAL-user                            = coalesce(src_user,dest_user,"unknown")

I created a regex that I tested on regex101 which worked perfectly

,foo\\(?<user>[^,]+),

However, testing that regex in Splunk I get, "The regex '_raw=,foo(?[^,]+),' is invalid. Regex: unmatched closing parenthesis.
Any suggestions on how to get rid of the prefix and just keep the user name?

0 Karma

jwalzerpitt
Motivator

Finally figured this out. Used the following which worked:

EXTRACT-foo_user = ,foo(?:\\\\|\\)(?<user>[^,]+),
0 Karma

to4kawa
Ultra Champion

props.conf

EVAL-user = trim(coalesce(src_user,dest_user,"unknown"),"foo\\")
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...