Splunk Search

Extracting a field after a certain text string

FC50
Path Finder

Hello, I'm trying to extract some SSID info into a field in Splunk. This info comes after a certain text string in some Cisco WLC logs. Sample logs:

Jul 18 15:00:27 10.171.12.44 DA-WLC-03: *Dot1x_NW_MsgTask_0: Jul 18 15:00:25.919: %APF-3-AUTHENTICATION_TRAP: [SA]apf_80211.c:20019 Client Authenticated: MACAddress:fa:f0:6c:56:34:bf Base Radio MAC:a0:93:51:22:38:b0 Slot:0 User Name:dave2345@ox.ac.uk Ip Address:10.156.4.11 SSID:eduwifi

Jul 18 15:20:3510.171.12.44 DA-WLC-03: *Dot1x_NW_MsgTask_0: Jul 18 15:20:33.510: %APF-3-AUTHENTICATION_TRAP: [SA]apf_80211.c:20019 Client Authenticated: MACAddress:b8:27:56:34:cc:d0 Base Radio MAC:a0:93:51:22:38:b0 Slot:0 User Name: unknown Ip Address:10.156.4.11 SSID:W-Guest

These logs are often different lengths but the common feature I want to initially capture as a field is what comes after the text SSID:

I can use this basic regex string in testing on regex101.com and it seems to do the trick:
(?:<=SSID:).*

but whenever I try toeither extract the field or use the rex command in splunk it does not work. Please could someone tell me if this is the correct regex expression and what formatting would i need to use in splunk to extract the field ?  

 

wifiThis seems to be a common request but I can't get it to work 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You don't need to use lookbehind in your instance particularly, just include the anchor in the expression

| rex "SSID:(?<ssid>.*)"

 

View solution in original post

0 Karma

FC50
Path Finder

Excellent, thanks 

0 Karma

FC50
Path Finder

Correction the working regex expression should read:

(?<=SSID:).*

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You don't need to use lookbehind in your instance particularly, just include the anchor in the expression

| rex "SSID:(?<ssid>.*)"

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...