Getting Data In

extracting the same field from the same sourcetype in an index, but with multiple log formats

toddblake
Explorer

Linux logs su failures like so:

Sep 23 15:23:25 linuxhost su[6903]: pam_unix(su-l:auth): authentication failure; logname= uid=99 euid=0 tty=pts/3 ruser=nobody rhost=  user=myuser

Whereas solaris logs them like this:

Sep 23 15:07:50 solhost su[23608]: [ID 810491 auth.crit] 'su root' failed for myuser on /dev/pts/1

I wanted to extract a user field using the rex command and came up with the following:

for linux: I can just use the user field

for solaris: rex field=_raw "failed for (?<user>\w) on)"

So ultimately I'd like to be able to search for either string, and then extract the user field and report on that field regardless of log format. Any ideas?

Tags (1)
0 Karma

jonuwz
Influencer

Something like :

rex field=_raw ".*(?:failed for |user=)(?<user>\w+).*"

toddblake
Explorer

oh neat thanks, didn't know there was an OR operator(the pipe) in a regex, and didn't think to parse out the name=value pair since it normally does it on it's own anyway. Seems to do the trick, thanks!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...