Splunk Search

Extract username with dash (-) Field from event

miberecz
Loves-to-Learn

Hello Everyone,

 

I'm trying to extract usernames from the logs of a proftpd.

An event looks like this:

2021-11-16 16:17:43,866 HOST proftpd[28071] 10.10.10.10 (11.11.11.11[22.22.22.22]): USER ASD-ASDASD: Login successful.

 

Simple usernames (ASDFG) works fine, also usernames with _ like ASD_ASD. But as soon as the username contains - character, its only extract the first part ASD-ASDASD

How do I circumvent this? How can I extract strings that contains - ?

 

 

Labels (2)
0 Karma

johnhuang
Motivator

| makeresults
| eval _raw = "2021-11-16 16:17:43,866 HOST proftpd[28071] 10.10.10.10 (11.11.11.11[22.22.22.22]): USER ASD-ASDASD: Login successful."
| rex field=_raw ":\sUSER\s(?<user_id>[^:]*)"
| table user_id

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What extraction are you currently using?

0 Karma

miberecz
Loves-to-Learn

It was extracted automatically, and so far I trusted it until I realized its not complete. Now I believe I need a regex the gets everything  after the string USER and before the : 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Extracting everything between "USER" and a colon (":") is relatively easy:

USER\s(?<username>[^:]*):

There is one caveat though. If your username contains a colon (":"), it will only capture the username up to (and without) that colon.

BTW, you could try TA for proftpd - https://github.com/jewnix/TA-proftpd

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...