Getting Data In

add regular expression for cisco ISE accounting logs CmdAV=show CmdArgAV=license CmdArgAV=usage

sushraw
Engager

Hello all,

can someone help me to to extract field 'CmdSet' from cisco ISE accouting logs. string : '[ CmdAV=show CmdArgAV=license CmdArgAV=usage CmdArgAV=<cr> ]'

Labels (1)
0 Karma

KothariSurbhi
Loves-to-Learn Everything

Hello @sushraw 

Can you please try appending below - 

| makemv CmdArgAV 
| eval CmdArgAV = replace(CmdArgAV, "\n", ", ")

 

The final results based on the sample event you shared would be -

| makeresults 
| eval _raw="Mar 26 15:37:59 <device_IP> <device_name>_Passed_Authentications 0045846127 2 0 2024-03-26 14:37:59.011 +00:00 06024423114 5202 NOTICE Device-Administration: Command Authorization succeeded, ConfigVersionId=1398, Device IP Address=<device_IP>, DestinationIPAddress=<device_IP>, DestinationPort=49, UserName=<user>, CmdSet=[ CmdAV=show CmdArgAV=running-config CmdArgAV=interface CmdArgAV=Ethernet1/19 CmdArgAV=<cr> ], Protocol=Tacacs, MatchedCommandSet=Unsafecommand, RequestLatency=10, NetworkDeviceName=<device_name>" 
| rex field=_raw "CmdSet=\[(?<CmdSet>[^\]]+)\]" 
| rex field=CmdSet max_match=0 "CmdArgAV=(?<CmdArgAV>[^\s]+)" 
| makemv CmdArgAV 
| eval CmdArgAV = replace(CmdArgAV, "\n", ", ")

 

Below screenshot for your reference -

 

KothariSurbhi_0-1711809498250.png

If this reply helps you, Karma would be appreciated.

0 Karma

sushraw
Engager

Hello @meetmshah 

i would like to thank you for your reply.

but i am looking to extract 'CmdSet' field.

i am using 'rex field=CmdSet "CmdAV=(?<Command>[^\s]+)|\sCmdArgAV=(?<Command1>[^\s]+)" '

but it is giving output till 1st CmdArgAV value

 

sushraw_0-1711561368589.png

 

0 Karma

meetmshah
Builder

Hello @sushraw, Can you please try below - 

| rex field=_raw "CmdSet=\[(?<CmdSet>[^\]]+)\]"
| rex field=CmdSet "CmdArgAV=(?<CmdArgAV>[^\s]+)"

 

Please accept the solution and hit Karma, if this helps! 

sushraw
Engager

hi @meetmshah 

thanks for your reply. but not working as expected

sushraw_0-1711563353180.png

 

0 Karma

meetmshah
Builder

Oh we will need to add max_match=0 in rex. Example below - 

| rex field=_raw "CmdSet=\[(?<CmdSet>[^\]]+)\]"
| rex field=CmdSet max_match=0 "CmdArgAV=(?<CmdArgAV>[^\s]+)"

Can you please have a check and me know how it goes?

0 Karma

sushraw
Engager

@meetmshahthanks 'max_match=0' helped.

but command keywords are separated by 'Enter'. is there any options to keep all words in one line?

sushraw_0-1711598829000.png

 

0 Karma

meetmshah
Builder

Can you please try appending below - 

| makemv delim="," allowempty=t CmdArgAV

 

Please accept the solution and hit Karma, if this helps!

0 Karma

sushraw
Engager

Hi @meetmshah 

not working as expected.

sushraw_0-1711621500691.png


search :- log_type=Passed_Authentications MESSAGE_TEXT="Command Authorization succeeded"  | rex field=CmdSet max_match=0 "CmdAV=(?<Command>[^\s]+)|\sCmdArgAV=(?<Command1>[^\s]+)" | makemv delim="," allowempty=t Command1 | table _time,Command,Command1

0 Karma

sushraw
Engager

TACACS event:

Mar 26 15:37:59 <device_IP> <device_name>_Passed_Authentications 0045846127 2 0 2024-03-26 14:37:59.011 +00:00 06024423114 5202 NOTICE Device-Administration: Command Authorization succeeded, ConfigVersionId=1398, Device IP Address=<device_IP>, DestinationIPAddress=<device_IP>, DestinationPort=49, UserName=<user>, CmdSet=[ CmdAV=show CmdArgAV=running-config CmdArgAV=interface CmdArgAV=Ethernet1/19 CmdArgAV=<cr> ], Protocol=Tacacs, MatchedCommandSet=Unsafecommand, RequestLatency=10, NetworkDeviceName=<device_name>

0 Karma

meetmshah
Builder

Hello @sushraw, Can you please try below - 

| rex field=_raw "CmdSet=\[(?<CmdSet>[^\]]+)\]"

The above should extract CmdSet from the events.

If it looks good, you can write search time field extraction to extract the field CmdSet automatically.

Please accept the solution and hit Karma, if this helps!

0 Karma

meetmshah
Builder

Hello @sushraw, Can you please share sample events in order to create the regex? Sample event along with the field value that you want to extract.

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...