Splunk Search

Help on construct rex expression

mariaerh
New Member

Hello All,

From a search in Splunk I get this output from the _raw field:

(I have modified a bit the output for privace)

_raw
Oct 27 18:03:25 index-name-here postfix/smtp[xxxx]: 00000000000: to=xxx@xxx.com, relay=xxx.com[x.x.x.x]:xx, delay=0.00, delays=0.00/0.00/0.0/0.00, dsn=0.0.0, status=bounced (host xxx.com[x.x.x.x] said: 550 No Such User Here" (in reply to RCPT TO command))

I need to extract this info from the raw data:
status=bounced (host xxx.com[x.x.x.x] said: 550 No Such User Here" (some-text-here))

How can I do that using a rex expression on the search?

Thank you!

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

no, that's default behaviour. no need to specify.

0 Karma

mariaerh
New Member

Thanks all for the answers, I will try and let you know.

One last question, don't I have to include this "field=_raw" right after the command rex ?

0 Karma

kristian_kolb
Ultra Champion

didn't the rex above work?

0 Karma

adylent
Path Finder

You can grab from status to the end of the line like this:

rex "status\=(?<Status>.*)"

OR just the single word like this:

rex "status\=(?<Status>\w)"

0 Karma

mariaerh
New Member

Hello 😃

After status I need to consider the whole value:

status=bounced (host xxx.com[x.x.x.x] said: 550 No Such User Here" (in reply to RCPT TO command))

Can I have this in 1 field?

Thank you!

0 Karma

kristian_kolb
Ultra Champion

just what do you want to have? all in one field;

...| rex "(?<my_long_field>status=.*)$"

or do you want several smaller pieces?

/K

lukejadamec
Super Champion

What after status=bounced does the rex need to consider?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...