Splunk Search

How to exclude a particular value from results when using the field extractor utility?

samuelrey
New Member

The field extractor wizard came up with the following:

(?=[^f]*(?:firewall:|f.*firewall:))^(?:[^"\n]*"){2}\s+(?P[^ ]+)(?:[^ \n]* ){4}(?P[^ ]+)(?:[^ \n]* ){3}(?P[^ ]+)\s+(?P[^ ]+)\s+\d+\s+(?P[^ ]+)[^"\n]*"(?P[^"]+)(?:[^ \n]* ){2}\((?P[^\)]+)

It sometimes interprets a field labeled msg (ex. msg="ip scan" is interpreted as user) as user for some reason (rare). When it does this, it always has a PolicyName="Internal Policy". It seems the easiest way to resolve the issue is to ignore any events having a PolicyName of 'Internal Policy'. How can I modify this regex/rex to accomplish that?

0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

When you're using the field extractor, sometimes you get weird values like you mentioned.

alt text

What you can do is click on the little X on the right side of the field that was incorrectly extracted.

alt text

After that, Splunk will try to recreate the the regular expression to exclude that value.


There is also a "require" option for selections in the field extractor. Adding more of these might help you filter out what you don't want.


Alternatively, as you mentioned, you can edit the regular expression. It becomes extra difficult since it is a machine generated regular expression, and often becomes easier to just write the regular expression (or multiple, simpler ones) instead of using the machine generated one. Either way, in that case, post some examples of the data (so someone could attempt to filter out the events with PolicyName or define the fields you want to try to extract)

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

When you're using the field extractor, sometimes you get weird values like you mentioned.

alt text

What you can do is click on the little X on the right side of the field that was incorrectly extracted.

alt text

After that, Splunk will try to recreate the the regular expression to exclude that value.


There is also a "require" option for selections in the field extractor. Adding more of these might help you filter out what you don't want.


Alternatively, as you mentioned, you can edit the regular expression. It becomes extra difficult since it is a machine generated regular expression, and often becomes easier to just write the regular expression (or multiple, simpler ones) instead of using the machine generated one. Either way, in that case, post some examples of the data (so someone could attempt to filter out the events with PolicyName or define the fields you want to try to extract)

samuelrey
New Member

Thanks. I was able how to use the method you described in the validate fields step correctly. I filtered on the unwanted value then excluded it.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...