Splunk Search
Highlighted

How to create a table for pfsense firewall logs using rex command?

New Member

I was trying to create a table for pfsense firewall logs using rex command. But it is not creating a table, instead showing the raw logs.

host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?[0-9A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?[A-Za-z0-9]),[0-9],(?[A-Za-z0-9.:]),(?[A-Za-z0-9.:]),(?[0-9]),(?[0-9]*)"

Can anyone point the error in the above command?

0 Karma
Highlighted

Re: How to create a table for pfsense firewall logs using rex command?

SplunkTrust
SplunkTrust

The rex command just extracts fields from raw data, doesn't show in tabular format. You should be able to see the fields (if extraction is correct) on the field sidebar on the left. You'd need to specify a table command explicitly, with the fields that you want, to view a tabular output.

0 Karma
Highlighted

Re: How to create a table for pfsense firewall logs using rex command?

Builder

@jawadak, can you try by this:

host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?<field1>[0-9A-Za-z]),(?<field2>[A-Za-z]),(?<field3>[A-Za-z]),(?<field4>[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?<field5>[A-Za-z0-9]),[0-9],(?<field6>[A-Za-z0-9.\:]),(?<field7>[A-Za-z0-9.\:]),(?<field8>[0-9]),(?<field9>[0-9]*)"| table field*

If that not work can you please share the exampleof one event to test.

Regards

View solution in original post

0 Karma
Highlighted

Re: How to create a table for pfsense firewall logs using rex command?

New Member

Thanks, it worked

0 Karma