Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Field extraction
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to create report for events whose field names haven't been extracted. I have SSH logs of the format "Accepted publickey for user XYZ" , "Accepted publickey for user ABC" and so on. I want to collect statistics for XYZ and other users. When I test an extraction, I get a javascript error on page which says invalid argument. Even if I save a field extraction, I'm not able to use it in my search. Can someone please tell me how to go about it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not sure why you getting java script error maybe an issue with your browser...
There are several methods to extract fields:
First i usually use erex to see what regex will catch my field values:
... | erex user examples="XYZ, ABC" counterexamples="99/2"
Then it will give me a regex which i would use in rex command:
... | rex field=_raw "Accepted\spublickey\sfor\suser\s(?<user>.*[^\s]) "
Then I Use the Field extractions page in Manager.
Here you will find all the methods to extract fields : Fields and field extractions
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not sure why you getting java script error maybe an issue with your browser...
There are several methods to extract fields:
First i usually use erex to see what regex will catch my field values:
... | erex user examples="XYZ, ABC" counterexamples="99/2"
Then it will give me a regex which i would use in rex command:
... | rex field=_raw "Accepted\spublickey\sfor\suser\s(?<user>.*[^\s]) "
Then I Use the Field extractions page in Manager.
Here you will find all the methods to extract fields : Fields and field extractions
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That worked perfectly! Thanks.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
