Splunk Search

Field Extraction from Raw Data

Dandanos
Engager

Hello,

Im new to splunk and just started learning it and im having little issues extracting some fields from a raw data

ex: of Ram Data
04/12 15:50:38 [LOGON] [1860] Domain: SamLogon: Network logon of Domain\test1$ from machine1 Returns 0xC0000064

I would like to extract the following

SamLogon : Network logon of Domain\test1$ from machine1
Returns : 0xC0000064

im trying to use the regex in props.conf in SH

Any help would be appreciated . Thanks

0 Karma

to4kawa
Ultra Champion

I'm trying to use the regex in props.conf in SH

in SH?
see: https://answers.splunk.com/answers/6820/search-head-props-conf.html

You're probably using it as a standalone,
props.conf

EXTRACT-fields = SamLogon: (?<Samlogon>.*) Returns (?<Returns>\S+)
0 Karma

codebuilder
SplunkTrust
SplunkTrust

Run your search as you have it, pipe your results to erex (may favorite hidden gem in Splunk).

The first "SamLogon" value is what you name the field, it's arbitrary. The second is the value that Splunk searches for.
Run the search, the examine the Job Inpspector, it will provide the regex that Splunk used to find the value.
You can fine tune it from there, but it is a fantastic starting point...

| erex SamLogon examples="SamLogon"

Documentation: https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex#Examples

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you share what you've tried in props.conf?
How fixed is the data you're parsing? Are there any pieces of text a regular expression can key on?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...