Splunk Search

Help with regex with two different type events

vrmandadi
Builder

Hello I have the below sample events
Thu Sep 5 10:00:02 EDT 2019 XDB EXPIRED & LOCKED 28-SEP-11 CTXAPP

Thu Sep 5 10:00:02 EDT 2019 VWEinsnte3345 LOCKED GPW_READ
Thu Sep 5 10:00:02 EDT 2019 SK_RYT LOCKED(TIMED) CDS_SELECT_ALL

I want to extract XDB , VWEinsnte3345 ,SK_RYT AS USERNAME and EXPIRED & LOCKED , LOCKED , LOCKED(TIMED) as status , 28-SEP-11 as expiry date(this field is not there for all events) and CTXAPP , GPW_READ , CDS_SELECT_ALL as ROLE

Below is the regex I am using but this is only extracting for event 2

EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>[^ ]+)\s*(?<ROLE>[^ ]+)

Thanks in advance

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi vrmandadi,
you could try to use two regexes to extract fields:

| rex "EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>.*)\s+(?<ROLE>[^ ]+)$"
| rex field=STATUS "(?<STATUS1>.*)\s+(?<expity_date>\d+-\w+-\d+)"
| eval STATUS=coalesce(STATUS1, STATUS)

The second regex runs with events with expiry date and the second one with events without it.
You can test the first regex in https://regex101.com/r/oNrmd0/1 and the second one in https://regex101.com/r/oNrmd0/2

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi vrmandadi,
you could try to use two regexes to extract fields:

| rex "EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>.*)\s+(?<ROLE>[^ ]+)$"
| rex field=STATUS "(?<STATUS1>.*)\s+(?<expity_date>\d+-\w+-\d+)"
| eval STATUS=coalesce(STATUS1, STATUS)

The second regex runs with events with expiry date and the second one with events without it.
You can test the first regex in https://regex101.com/r/oNrmd0/1 and the second one in https://regex101.com/r/oNrmd0/2

Bye.
Giuseppe

vrmandadi
Builder

Thanks Much

0 Karma

DalJeanis
Legend

Try this

EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>\w+( & \w+)?)\s*(?<EXPIRY>\d+-[A-Z]+-\d+)?\s*(?<ROLE>[A-Za-z0-9_-]+)  

regex101.com is your friend.

https://regex101.com/r/ojcpz7/1

0 Karma

vrmandadi
Builder

Hello @DalJeanis I tried your regex but it did not work .I did try that in regex101 but it is not capturing everything for EXPIRY the values are 28-SEP-1 and ROLE has 1 which should be 28-SEP-11 and CTXAPP respectively .
The same with event 2 the status has value LOCKE and ROLE has D

0 Karma

mayurr98
Super Champion

is that your entire event? if not then could pls share the entire event?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...