Splunk Search

How to create regex for different pattern of data

seksit
Explorer

Hi everyone

I'm new splunk, I'm try to extract fields called username, clientip.

But some row of data start with "Invalid user (username)" , some row has only (username).

How can I create regex for this pattern data?

Sorry for my english 🙂

Thanks

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

This works fine for me. (things before the rex are just to generate sample data)

| gentimes start=-1 | eval temp="Thu Sep 29 2015 00:00:00 mailsv1 sshd[5276]: Failed password for invalid user appserver from 100.890.03.34 port 3351 ssh2#Thu Sep 29 2015 00:00:00 mailsv1 sshd[5276]: Failed password for root from 100.890.03.34 port 3351 ssh2" | table temp | makemv temp delim="#" | mvexpand temp | rename temp as _raw 
| rex "^(?:[^\s\n]* ){10}(invalid user )*(?P<username>\w+) from (?P<clientip>[^ ]+)"

View solution in original post

seksit
Explorer

Thanks everyone who came to help me.

0 Karma

somesoni2
Revered Legend

This works fine for me. (things before the rex are just to generate sample data)

| gentimes start=-1 | eval temp="Thu Sep 29 2015 00:00:00 mailsv1 sshd[5276]: Failed password for invalid user appserver from 100.890.03.34 port 3351 ssh2#Thu Sep 29 2015 00:00:00 mailsv1 sshd[5276]: Failed password for root from 100.890.03.34 port 3351 ssh2" | table temp | makemv temp delim="#" | mvexpand temp | rename temp as _raw 
| rex "^(?:[^\s\n]* ){10}(invalid user )*(?P<username>\w+) from (?P<clientip>[^ ]+)"

seksit
Explorer

Hi somesoni2,

Now I can extract this pattern by using your regex. Thanks you for your your advice.

0 Karma

kennybms
New Member

Something like this should do:

.. rex field=_raw "Invalid user (?<InvalidUser>.*\").*\" ..
0 Karma

3stimpson
Engager

Can you provide a snippet of the data in text format, with both formats included?

update: sorry scratch below, I didn't see the jpg
Better yet you can use the IFX tool to extract on your own...
http://docs.splunk.com/Documentation/Splunk/6.3.0/Knowledge/ExtractfieldsinteractivelywithIFX

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...