Splunk Search

Field extraction and regex strategy

asarolkar
Builder

I have log that looks like this:

2012-02-23 09:25:21 VShellSSH2 sftp 108660 172.59.56.8 62386 NESTLE - C:\SFTP\NESTLE\file.csv 0 0 350754 350754 - - "108660: FLETCHER\NESTLE has accessed 'C:\SFTP\NESTLE\file.csv 350754 bytes downloaded"

I need to figure out a way to apply field extractions to extract the name of the org (which usually appears after the keyword FLETCHER\ ) and then similarly extract the # of bytes downloaded.

Any pointers so as to how I should go about it ?

Here's what Im thinking :

i) I will create a field extraction to pick out the name of the org - eg. NESTLE in this case
This field will be called org

ii) I will create a regex that will filter out the # of bytes downloaded. this field will be called usage

iii) I will do a sourcetype=SFTP_records stats bytes by org

Does that make sense ? There are multiple events like these for every ORG and needless to say there are multiple ORGS

1 Solution

carasso
Splunk Employee
Splunk Employee

1) You might be interested in looking at the Field Extractor app which will generate the regexes for you, if you just click on the values you want extracted.

2) you can have one regex to pull out both values. Something like "FLETCHER\\(?\w+).*?(?\d+) bytes"

3) you search needs to be something like: sourcetype=SFTP_records | stats sum(bytes) by org

View solution in original post

0 Karma

carasso
Splunk Employee
Splunk Employee

1) You might be interested in looking at the Field Extractor app which will generate the regexes for you, if you just click on the values you want extracted.

2) you can have one regex to pull out both values. Something like "FLETCHER\\(?\w+).*?(?\d+) bytes"

3) you search needs to be something like: sourcetype=SFTP_records | stats sum(bytes) by org

0 Karma
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...