Splunk Search

How do I skip a word extracted by the regular expression generated using the Field Extractor?

danielgp89
Path Finder

I'm so desperate! how do I skip a value from the regular expressions? For example in these lines.

I don't want to extract the word "invalid"! I only want to extract the users (root, apache, mail and games), but when I apply the regular expression, it brings me invalid. How do I skip that word?

Thu Oct 31 2016 00:15:06 mailsv1 sshd[5276]: Failed password for invalid user appserver from xxx.x.xx.xx port 3351 ssh2
Thu Oct 31 2016 00:15:06 mailsv1 sshd[1039]: Failed password for root from xxx.x.xx.xx port 3768 ssh2
Thu Oct 31 2016 00:15:06 mailsv1 sshd[1165]: Failed password for apache from xxx.x.xx.xx port 4604 ssh2
Thu Oct 31 2016 00:15:06 mailsv1 sshd[4998]: Failed password for mail from xxx.x.xx.xx port 1552 ssh2
Thu Oct 31 2016 00:15:06 mailsv1 sshd[1930]: Failed password for games from xxx.x.xx.xx port 3007 ssh2
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try this, the fieldname will be UserName

for\s(?<UserName>\w+)\sfrom

View solution in original post

0 Karma

gokadroid
Motivator

If each line is an individual event and your current extraction is working fine for all other users, then why don't you try to cut the "not required bit" at the source query by using NOT "for invalid" in the search string so that you don't get these results at all.

0 Karma

danielgp89
Path Finder

Hi gokadroid!

I tried that. But when I cut all the logs and I use in the event action the field extractor it works fine, but at the moment I do a search with new field that I created, it also bring the word invalid and another ones that I don't want.

0 Karma

adauria_splunk
Splunk Employee
Splunk Employee

You need to make the word invalid optional. maybe this:

for\s(invalid )?(?<UserName>\w+)\sfrom
0 Karma

danielgp89
Path Finder

Thanks Adauria!

This solve my problem.

Best Regards.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this, the fieldname will be UserName

for\s(?<UserName>\w+)\sfrom

0 Karma

danielgp89
Path Finder

Thanks skoelpin

This Solve my problem.

Best Regards!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...