Splunk Search

How to extract multiple hostname from one regex search in globalprotect logs?

briansarmiento
Explorer

Hi everyone,

I'm trying to create a simple list with all the devices found on the logs from globalprotect. The deal is, i'm using rex to match it with regular expressions.  I've already used  regex101.com to double check my search but, when I run it on splunk it fails.

My search:

index="ind_Aaaabbbb" log_subtype="globalprotect" globalprotectgateway-config-succ OR globalprotectgateway-logout-succ
| rex field=_raw (?<device>\w\w\w\w\w\w\s\w\w\w\w:\s+(?:\w+\-\w+\-\w+|\w+))
| table _time, user, event_id, src_ip, device, dvc_name, dvc

 

The ideal expresions to capture:

Device name: DDD-AAA-BBBBB

Device name: DDDAAABBBBBBB

 

Error returned by Splunk:

Error in 'SearchParser': Missing a search command before '\'. Error at position '198' of search query 'search index="index" log_subtype="globalpro...{snipped} {errorcontext = -\w+\-\w+|\w+)) | tab}'.

 

Example data:

SYSTEM,globalprotect,0,2020/11/29,,globalprotectgateway-config-succ,Gateway-XXX-XX-XXX-N,0,0,general,informational,"GlobalProtect gateway client configuration generated. username.5, Private IP: 00.000.000.00, Client version: 5.1.1-12, Device name: DDD-AAA-BBBBB, Client OS version: Microsoft Windows 10 Pro , 64-bit, VPN type: Device Level VPN.",000...,0x0,0,0,0,0,,FW-PA-0000-AAA-CCC-TTTT

SYSTEM,globalprotect,0,2020/11/29 ,,globalprotectgateway-config-succ,Gateway-XXX-XX-N,0,0,general,informational,"GlobalProtect gateway client configuration generated. username.5, Private IP: 00.000.000.000, Client version: 5.1.5-20, Device name: DDDAAABBBBBBB, Client OS version: Microsoft Windows 10 Pro , 64-bit, VPN type: Device Level VPN.",000...,0x0,0,0,0,0,,FW-PA-0000-AAA-CCC-TTTT

 

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I suspect rex doesn't like the embedded pipe character.  Try this query that not only doesn't use a pipe, it's also tons more efficient (51 steps vs. 3250).

(?<device>Device name:\s+\w{3}-?\w{3}-?\w{5,7})
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I suspect rex doesn't like the embedded pipe character.  Try this query that not only doesn't use a pipe, it's also tons more efficient (51 steps vs. 3250).

(?<device>Device name:\s+\w{3}-?\w{3}-?\w{5,7})
---
If this reply helps you, Karma would be appreciated.

briansarmiento
Explorer

Hi @richgalloway  unfortunately that search didn't help, It stills returning an error. This time its the following


Error in 'rex' command: Encountered the following error while compiling the regex '(?<device>Device': Regex: missing closing parenthesis.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

No such error here.  Please share your full query.

richgalloway_0-1606917443201.png

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

briansarmiento
Explorer

Hey @richgalloway , 
here is my full query.

briansarmiento_0-1606917640972.png

Thanks in Advance for your Help.! (Y)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rex command requires the regex be enclosed in quotation marks.

---
If this reply helps you, Karma would be appreciated.

briansarmiento
Explorer

Perfect, it totally worked. Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...