Splunk Search

How to create a table for pfsense firewall logs using rex command?

New Member

I was trying to create a table for pfsense firewall logs using rex command. But it is not creating a table, instead showing the raw logs.

host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?[0-9A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?[A-Za-z0-9]),[0-9],(?[A-Za-z0-9.:]),(?[A-Za-z0-9.:]),(?[0-9]),(?[0-9]*)"

Can anyone point the error in the above command?

0 Karma
1 Solution

Builder

@jawadak, can you try by this:

host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?<field1>[0-9A-Za-z]),(?<field2>[A-Za-z]),(?<field3>[A-Za-z]),(?<field4>[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?<field5>[A-Za-z0-9]),[0-9],(?<field6>[A-Za-z0-9.\:]),(?<field7>[A-Za-z0-9.\:]),(?<field8>[0-9]),(?<field9>[0-9]*)"| table field*

If that not work can you please share the exampleof one event to test.

Regards

View solution in original post

0 Karma

Builder

@jawadak, can you try by this:

host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?<field1>[0-9A-Za-z]),(?<field2>[A-Za-z]),(?<field3>[A-Za-z]),(?<field4>[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?<field5>[A-Za-z0-9]),[0-9],(?<field6>[A-Za-z0-9.\:]),(?<field7>[A-Za-z0-9.\:]),(?<field8>[0-9]),(?<field9>[0-9]*)"| table field*

If that not work can you please share the exampleof one event to test.

Regards

View solution in original post

0 Karma

New Member

Thanks, it worked

0 Karma

Revered Legend

The rex command just extracts fields from raw data, doesn't show in tabular format. You should be able to see the fields (if extraction is correct) on the field sidebar on the left. You'd need to specify a table command explicitly, with the fields that you want, to view a tabular output.

0 Karma