Dashboards & Visualizations

How to write a rex for an alphanumeric field extraction

av_
Path Finder

Need help with the extraction of an alpha numeric field. E.G. : ea37c31d-f4df-48ab-b0b7-276ade5c5312

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use a character class - it looks like this is hexadecimal with some hyphens thrown in so try

[a-f0-9-]
0 Karma

av_
Path Finder

Thanks @ITWhisperer . 
[^\"] worked for me.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as that probably seems to be UUID string, you could make more strict regex to match it like

[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}

Time by time your data could contains some data which could match e.g. [^\"]+ but it's still e.g. UUID.

Also those regex use different amount of resources. With only some events this is usually not an issue, but if/when you have e.g. billions of events then even 1ms start to make difference. You could look that e.g. with regex101.com. 

This happened quite often e.g. with SSN + bank accounts etc. So look your data and use expression which match best for your data!

r. Ismo 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Cool - you obviously have more (unshared) knowledge about your events, which I could not easily have guessed at!

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...