Splunk Search

Help with regex search

jhampton3rd
Explorer

Good Afternoon,

I would like to use a regex search to get "Inbound TCP connection denied" and "High". What's the correct regex command to pull these out of the CEF event. Also, I'll eventually would like to create a table showing how many "High", "Medium", "Low" events show up in the last hour.

Jul 24 11:32:11 host-host-h05 CEF:0|CISCO|ASA||106001|Inbound TCP connection denied|High| eventId=1247891

Thanks for your help.

Tags (3)
1 Solution

lguinn2
Legend

I don't think you want regex - if what you want to do is to extract the data into a field, you want rex. For example

yoursearchhere
| rex "(?:.*?\|){5}(?<message>.*?)\|(?<level>.*?)\|"

This gives you two fields message and level. It assumes that there are 5 | (pipe) symbols before the message string and that the fields are delimited with additional |.

You could get the table by doing this

yoursearchhere
| rex "(?:.*?\|){5}(?<message>.*?)\|(?<level>.*?)\|"
| stats count by level

View solution in original post

lguinn2
Legend

I don't think you want regex - if what you want to do is to extract the data into a field, you want rex. For example

yoursearchhere
| rex "(?:.*?\|){5}(?<message>.*?)\|(?<level>.*?)\|"

This gives you two fields message and level. It assumes that there are 5 | (pipe) symbols before the message string and that the fields are delimited with additional |.

You could get the table by doing this

yoursearchhere
| rex "(?:.*?\|){5}(?<message>.*?)\|(?<level>.*?)\|"
| stats count by level

jhampton3rd
Explorer

Thanks lguinn. Big Help!!!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...