Splunk Search

Comparing regex and print result if a specific condition is met

mtanadsk
Explorer

Hi,

I've searched through the Answers section, with not much help. What I'd like to do is to parse a log entry, to collect specific fields, and to compare those fields against a known value. If and only if the field(s) do not match a known value, print the result so I can create an alert for it.

Sample log file:

Oct  9 23:28:05 10.100.200.10 Juniper: 2013-10-10 00:28:05 - vpnhostXXX - [1.2.3.4] test_user(FOO-NC)[BarNC] - Network Connect: Session started for user with IP 10.10.10.10, hostname test_user_hostname

Using the log sample above, I'd like to check that a particular user, "test_user" connects to the VPN using ONLY a known host, in this case, "test_user_hostname". If "test_user" connects with a different host OR "test_user_hostname" connects with a different "test_user" ID, then I'd like to alert on it.

This is the query I've constructed, thus far (using Regex generated from 'Extract Field'):

... | rex "(?i) hostname (?P.+)" | rex "(?i)^[^\[]*\[\d+\.\d+\.\d+\.\d+\]\s+(?P[^\(]+)"

Pseudocode:
print search result IF test_user != test_user_hostname

Test:
If test_user connects with a host other than test_user_hostname, Splunk should return that result with the name of that host in the search result(s).

I'm struggling with coming up with the appropriate conditional statement(s).

Any help is much appreciated.

thanks,
-mike

Tags (2)
0 Karma

Lucas_K
Motivator

Looks like you want to use the regex command.

"Removes or keeps results that match the specified regular expression."

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Regex

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...