Field extraction

[splunkingsplun1]

I used the IFX tool in Splunk for some of my logs. I am trying to extract the severity of attacks in my IPS logs which are categorized (high, medium, low, info/informational). The logs look something like this:

Dec 25 08:58:14 172.16.48.100 Netdefender: 25-12-2013 08:55:21 WARNING 12572 Intrusions "SIP-Scanner-SIPVicious" UDP 188.138.34.198 5077 172.16.48.100 5060 1 Regular "Primary_Aggregate" occur 1 3 N/A 0 N/A high drop FFFFFFFF-FFFF-FFFF-0027-000052F2B407

Dec 25 08:55:21 172.16.48.150 Netdefender: 25-12-2013 08:55:21 WARNING 350 Anti-Scanning "TCP Scan" TCP 198.20.99.130 0 0.0.0.0 0 0 Regular "Primary_Aggregate" ongoing 0 0 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-1E24-000052F089EF

Dec 25 08:55:26 172.16.48.200 Netdefender: 25-12-2013 08:55:20 WARNING 350 Anti-Scanning "TCP Scan" TCP 42.114.23.195 0 0.0.0.0 0 0 Regular "Primary_Aggregate" ongoing 3 1 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-52BF-000F521C7F60

Dec 25 08:55:16 172.16.48.150 Netdefender: 25-12-2013 08:55:16 WARNING 350 Anti-Scanning "TCP Scan" TCP 198.20.99.130 0 0.0.0.0 0 0 Regular "Primary_Aggregate" ongoing 2 0 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-1E24-000052F089EF

Dec 25 08:55:16 172.16.48.150 Netdefender: 25-12-2013 08:55:16 WARNING 350 Anti-Scanning "TCP Scan" TCP 198.20.99.130 0 0.0.0.0 0 1 Regular "Primary_Aggregate" start 0 0 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-1E24-000052F089EF

Dec 25 08:55:21 172.16.48.200 Netdefender: 25-12-2013 08:55:15 WARNING 350 Anti-Scanning "TCP Scan" TCP 198.143.173.176 0 0.0.0.0 0 0 Regular "Primary_Aggregate" term 0 0 N/A 0 N/A medium drop FFFFFFFF-FFFF-FFFF-6C70-000F521C7F60

This is the regex that IFX generated:

(?i)/.*? (?P<FIELDNAME>[a-z]+)(?= )

So to test I did:

sourcetype=netdefender | rex field=_raw "(?i)/.*? (?P<FIELDNAME>[a-z]+)(?= )"

For some reason the field FIELDNAME is extracting some occurrences of the values (term, ongoing, sampled, TCP). Does anyone have any ideas on a regex they can help me with?

[gfuente · Accepted solution]

Hello

You can use this regex instead:

\s(?<severity>high|medium|info|informational|low)\s

In your search

sourcetype=netdefender | rex field=_raw "\s(?<severity>high|medium|info|informational|low)\s"

Regards

[splunkingsplun1]

Yes that seems to be the obvious answer... Sorry! Low on caffeine and a beginning regexer is my excuse.