Splunk Search

Field extraction

Sheela
Path Finder

I want to create report for events whose field names haven't been extracted. I have SSH logs of the format "Accepted publickey for user XYZ" , "Accepted publickey for user ABC" and so on. I want to collect statistics for XYZ and other users. When I test an extraction, I get a javascript error on page which says invalid argument. Even if I save a field extraction, I'm not able to use it in my search. Can someone please tell me how to go about it?

Tags (1)
0 Karma
1 Solution

MarioM
Motivator

I am not sure why you getting java script error maybe an issue with your browser...

There are several methods to extract fields:

First i usually use erex to see what regex will catch my field values:

... | erex user examples="XYZ, ABC" counterexamples="99/2"

Then it will give me a regex which i would use in rex command:

... | rex field=_raw "Accepted\spublickey\sfor\suser\s(?<user>.*[^\s]) "

Then I Use the Field extractions page in Manager.

Here you will find all the methods to extract fields : Fields and field extractions

View solution in original post

MarioM
Motivator

I am not sure why you getting java script error maybe an issue with your browser...

There are several methods to extract fields:

First i usually use erex to see what regex will catch my field values:

... | erex user examples="XYZ, ABC" counterexamples="99/2"

Then it will give me a regex which i would use in rex command:

... | rex field=_raw "Accepted\spublickey\sfor\suser\s(?<user>.*[^\s]) "

Then I Use the Field extractions page in Manager.

Here you will find all the methods to extract fields : Fields and field extractions

Sheela
Path Finder

That worked perfectly! Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...