All Apps and Add-ons

Splunk Add-on for Cisco WSA: How to extract the user from Cisco WSA logs?

kiran331
Builder

Hi

From the Cisco WSA logs, I get the user information as user=ABCDEFEGH\kiran@ka.ABCDEFEGH.com.

What should I use in props.conf to extract the user by removing

ABCDEFEGH\ 

and

@ka.ABCDEFEGH.com 

at indexing time?

0 Karma

sk314
Builder

Try this:

EXTRACT-username = user=[^\\]+\\(?<username>[^@]+)@
0 Karma

kiran331
Builder

Hi Sk314, Thanks for the response, I tried its not working.

0 Karma

sk314
Builder

can you paste your entry in props.conf here? Does this work in search

<your index and sourcetype> | rex field=_raw "user=[^\\]+\\(?<username>[^@]+)@" | table username
0 Karma

kiran331
Builder

[cisco:wsa:squid]
EXTRACT-username = cs_username=[^\]+\(?[^@]+)@

When I run search i got error

Error in 'rex' command: Encountered the following error while compiling the regex 'user=[^]+(?[^@]+)@': Regex: unmatched parentheses

0 Karma

sk314
Builder

Try this instead:

<your index and sourcetype> | rex field=_raw "user=[^\\\]+\\\(?<username>[^@]+)@" | table username
0 Karma

kiran331
Builder

Its working, But not for all users

0 Karma

sk314
Builder

Can you specify where it fails? I just saw that you use cs_username in your props? You might be better off using Splunk's field extractor instead.
Reference: https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ExtractfieldsinteractivelywithIFX

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...