Splunk Search

Help with SPL and REX for 2 separate ID's in 1 event

LizAndy123
Explorer

I have an Event where I can extract the 2 different ID's but how do I show that id 1 gave access to id 2?

Sample event 

User-ABCDEFG assigned Role-'NewRole' on Project-1234 to ABCDEFG

I need to say the User-ABCDEFG gave access to ABCDEFG in a stats sort of way - the user may give 4 or 5 accesses a day so I would then create a report which shows that that user did.

Labels (1)
Tags (1)
0 Karma
1 Solution

rafamss
Contributor

Hi @LizAndy123,

Following the @gcusello understanding, I added a few more context to the results.

| rex field=_raw "User-(?<User>\w+)\s+assigned\s+Role-(?<Operation_Type>.+?)\s(?<Where>.+?)\sto\s(?<ToUser>.+?)$"

 In these case, I'm supposing that you can tell to the stakeholders the following:

User= The person who execute the operation

Operation_Type= What operation was did

Where= The asset that was changed in this operation

ToUSer= The user whom received the permission

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @LizAndy123 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

rafamss
Contributor

Hi @LizAndy123,

Following the @gcusello understanding, I added a few more context to the results.

| rex field=_raw "User-(?<User>\w+)\s+assigned\s+Role-(?<Operation_Type>.+?)\s(?<Where>.+?)\sto\s(?<ToUser>.+?)$"

 In these case, I'm supposing that you can tell to the stakeholders the following:

User= The person who execute the operation

Operation_Type= What operation was did

Where= The asset that was changed in this operation

ToUSer= The user whom received the permission

 

gcusello
SplunkTrust
SplunkTrust

Hi @LizAndy123 ,

et me understand:

you want to extract the user fields (that's located at the beginning of the event) and the resource to access (that's located at the end of the event).

In  this case you have to use two regexes:

| rex "^(?<user>[^ ]+)"
| rex "(?<resource>\w+)$"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...