Splunk Search

Field extraction

splunkingsplun1
Explorer

I used the IFX tool in Splunk for some of my logs. I am trying to extract the severity of attacks in my IPS logs which are categorized (high, medium, low, info/informational). The logs look something like this:

Dec 25 08:58:14 172.16.48.100 Netdefender: 25-12-2013 08:55:21 WARNING 12572 Intrusions "SIP-Scanner-SIPVicious" UDP 188.138.34.198 5077 172.16.48.100 5060 1 Regular "Primary_Aggregate" occur 1 3 N/A 0 N/A high drop FFFFFFFF-FFFF-FFFF-0027-000052F2B407

Dec 25 08:55:21 172.16.48.150 Netdefender: 25-12-2013 08:55:21 WARNING 350 Anti-Scanning "TCP Scan" TCP 198.20.99.130 0 0.0.0.0 0 0 Regular "Primary_Aggregate" ongoing 0 0 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-1E24-000052F089EF

Dec 25 08:55:26 172.16.48.200 Netdefender: 25-12-2013 08:55:20 WARNING 350 Anti-Scanning "TCP Scan" TCP 42.114.23.195 0 0.0.0.0 0 0 Regular "Primary_Aggregate" ongoing 3 1 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-52BF-000F521C7F60

Dec 25 08:55:16 172.16.48.150 Netdefender: 25-12-2013 08:55:16 WARNING 350 Anti-Scanning "TCP Scan" TCP 198.20.99.130 0 0.0.0.0 0 0 Regular "Primary_Aggregate" ongoing 2 0 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-1E24-000052F089EF

Dec 25 08:55:16 172.16.48.150 Netdefender: 25-12-2013 08:55:16 WARNING 350 Anti-Scanning "TCP Scan" TCP 198.20.99.130 0 0.0.0.0 0 1 Regular "Primary_Aggregate" start 0 0 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-1E24-000052F089EF

Dec 25 08:55:21 172.16.48.200 Netdefender: 25-12-2013 08:55:15 WARNING 350 Anti-Scanning "TCP Scan" TCP 198.143.173.176 0 0.0.0.0 0 0 Regular "Primary_Aggregate" term 0 0 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-6C70-000F521C7F60

This is the regex that IFX generated:

(?i)/.*? (?P<FIELDNAME>[a-z]+)(?= )

So to test I did:

sourcetype=netdefender | rex field=_raw "(?i)/.*? (?P<FIELDNAME>[a-z]+)(?= )"

For some reason the field FIELDNAME is extracting some occurrences of the values (term, ongoing, sampled, TCP). Does anyone have any ideas on a regex they can help me with?

1 Solution

gfuente
Motivator

Hello

You can use this regex instead:

\s(?<severity>high|medium|info|informational|low)\s

In your search

sourcetype=netdefender | rex field=_raw "\s(?<severity>high|medium|info|informational|low)\s"

Regards

View solution in original post

0 Karma

gfuente
Motivator

Hello

You can use this regex instead:

\s(?<severity>high|medium|info|informational|low)\s

In your search

sourcetype=netdefender | rex field=_raw "\s(?<severity>high|medium|info|informational|low)\s"

Regards

0 Karma

splunkingsplun1
Explorer

Yes that seems to be the obvious answer... Sorry! Low on caffeine and a beginning regexer is my excuse.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...