Splunk Enterprise Security

Help with regex to print the value Total_bytes_recv and Total_bytes_send from log

sarbankumar
New Member

Log:

Aug 28 17:46:20 192.168.111.14 08/28/2019:16:46:18 GMT 0-PPE-0 : default TCP OTHERCONN_DELINK 1091143 0 : Source 192.168.2.166:19301 - Vserver 192.168.2.165:22 - NatIP 192.168.2.166:19301 - Destination 192.168.2.165:22 - Delink Time 08/28/2019:16:46:18 GMT **Total_bytes_send** 2333 - Total_bytes_recv **3173**
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Use this

|rex "Total_bytes_send (?<total_bytes_send>\d+)"
|rex "Total_bytes_recv (?<total_bytes_recv>\d+)"
------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

0 Karma

gcusello
Legend

Hi diogofgm,
you can use only one regex:

Total_bytes_send\*\*\s+(?<Total_bytes_send>\d+)\s+-\s+Total_bytes_recv\s+\*\*(?<Total_bytes_recv>\d+)

as you can test at https://regex101.com/r/3A8TRw/1

Bye.
Giuseppe

0 Karma

diogofgm
SplunkTrust
SplunkTrust

I know. But since the OP only posted one event and not I don't know all the variations of events containing these fields, using separate regexes is less risky since it will work on any event regardless the field order or position and its not really impacting performance doing with separate regexes.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

diogofgm
SplunkTrust
SplunkTrust

Use this

|rex "Total_bytes_send (?<total_bytes_send>\d+)"
|rex "Total_bytes_recv (?<total_bytes_recv>\d+)"
------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

0 Karma

sarbankumar
New Member

Total_bytes_send 2333 - Total_bytes_recv 3173

Quoted is the value of total_bytes_send and total_bytes_recv

0 Karma

sarbankumar
New Member

thanks it works.

0 Karma

Sukisen1981
Champion

hi @sarbankumar please try @diogofgm 's answer...it works 🙂 Please accept the answer if it works for you

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!