Splunk Search

How do I extract these two fields from a string in my sample data?

fbertoletti
New Member

Hello,

I have this logs :

Apr 26 12:49:09 10.30.245.203 Apr 26 14:49:12 MachineOne info tmm1[11869]: Rule /User_Agent <HTTP_RESPONSE>: src_ip=112.43.9.4,vip=110.12.8.8,http_method=GET,http_host=www.xxxx.it:443,http_uri=/files/visio.jpg,http_url=www.xxx.it:443/files/x/x/x/x/x.jpg,http_version=1.1,http_user_agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36",http_content_type=,http_referrer="https://x/",req_start_time=2016/04/26 14:49:12,cookie="_x",user=,virtual_server="/x x x",bytes_in=0,res_start_time=2016/04/26 14:49:12,node=x ,node_port=80,http_status=200,req_elapsed_time=5,bytes_out=13290 

I would like to only extract this part Windows NT 6.1 and Chrome/49.0.2623.112 in the http_user_agent field.

I also have another log with the valuesLinux and Chrome/49.0.2623.105

Apr 26 13:10:16 10.30.245.203 Apr 26 15:10:19 x info tmm[11869]: Rule /User_Agent <HTTP_RESPONSE>: src_ip=x,vip=x8,http_method=GET,http_host=x,http_uri=x,http_url=x,http_version=1.1,http_user_agent="Mozilla/5.0 (**Linux**; Android 4.4.2; LG-D213 Build/KOT49I.A1407976057) AppleWebKit/537.36 (KHTML, like Gecko) **Chrome/49.0.2623.105** Mobile Safari/537.36",http_content_type=,http_referrer="x",req_start_time=2016/04/26 15:10:19,cookie="x",user=,vir

I tried to use regex, but without the expected result.

Objective is to have table with:

OS                  Nav
Windows NT 6.1      Chrome/49.0.2623.112
Linux               Chrome/49.0.2623.10

thanks for your help 🙂

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This worked for me using your sample data. You can check other strings at regex101.com

... | rex field=http_user_agent "\((?P<OS>[^;\*]+);.*\)\s(?P<Nav>[^ \*]+)" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This worked for me using your sample data. You can check other strings at regex101.com

... | rex field=http_user_agent "\((?P<OS>[^;\*]+);.*\)\s(?P<Nav>[^ \*]+)" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

fbertoletti
New Member

Hello !

thank you, all seems to work.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...