Splunk Search

Field extraction from checkpoint log with two hostname values

dieguiariel
Path Finder

Hi! im traying to extract a field named hostname from checkpoint logs, but i couldn't with the wizards:

sample:

time=1606760596|hostname=CHKHOST|product=Mobile Access|action=Log In|ifdir=inbound|loguid={0x5fc53894,0x0,0x250a000a,0x2e9b}|origin=10.0.X.X|originsicname=CN\=FW01,O\=CHKHOST.localdomain|sequencenum=293|time=1606760596|version=5|auth_encryption_methods=AES-256 + SHA1 + Group 2|auth_method=RADIUS|client_build=986100611|client_name=Endpoint Security VPN|client_version=E81.10|cvpn_category=Session|device_identification={85FAD095-E5AB-43BA-AA8C-B205F783226E}|domain_name=localdomain|event_type=Login|failed_login_factor_num=0|host_ip=192.168.X.X|host_type=PC|hostname=NB-0237|lastupdatetime=1606760596|login_option=Standard|login_timestamp=1606760596|mac_address=40:5b:d8:64:5b:29|methods:=3DES + SHA1|office_mode_ip=10.193.0.89|os_bits=64bit|os_build=18363|os_edition=Enterprise|os_name=Windows|os_version=10|proto=6|proxy_src_ip=0.0.0.0|s_port=0|service=443|session_timeout=43200|session_uid={5FC53894-0000-0000-0A00-0A259B2E0000}|src=181.121.X.X|status=Success|suppressed_logs=0|tunnel_protocol=IPSec|user=agimenez|user_dn=agimenez|user_group=VPN_Group|
 
if you see there are two hostname fields, one with the checkpoint hostname and the other with the device connecting to the vpn. I need the second value.
 
In smart mode or verbose mode, splunk only detects the first hostname field.
How can i parse the second field? Ive tried field extraction wizard with regular expression only selecting the second hostname and i get this error:
 
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.
 
 
When i try using delimieters, selecting pipe, i get this error:
has exceeded the configured depth_limit, consider raising the value in limits.conf.
 
any help would be appreciated.
Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using rex.

... | rex max_match=2 "hostname=(?<hostname>[^\|]+)"
| eval hostname=mvindex(hostname,1)
...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try using rex.

... | rex max_match=2 "hostname=(?<hostname>[^\|]+)"
| eval hostname=mvindex(hostname,1)
...
---
If this reply helps you, Karma would be appreciated.

dieguiariel
Path Finder

Thank you!!! it works perfectly!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...