Splunk Search

How to obtain a variable for string value in a field?

Stephen11
Explorer

Need some help ...  I looked at several examples but not that straight forward ...  The rex and split functions were my best bet ... never got anything ... that really worked well. The split function only gave me the first part.  The rex function did not get me a variable assignment.

I need to be able to get a variable -- preferably through the eval function that captures the sid # in a variable like mySid.   See the sample string below.  I just need the # which in the example below which is 2008518.  The Sid # is going to be in the text string in different locations- i.e not the same exact absolute location in the string.  Appreciate the help!!! 🙂

Example - String 

 

A suspicious packet was sent [sid:2008518] -- Detected an attempt to make a configuration change in SQL DB using the legit 'sp_configure' command The xp_cmdshell option is a SQL Server server configuration option that enables system administrators to control whether the xp_cmdshell extended stored procedure can be executed on a system. By default, the xp_cmdshell option is disabled on new installations. Before enabling this option, it is important to consider the potential security implications associated with the use of this option. It is proposed to disable the xp_cmdhsell option.

 

Labels (3)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Stephen11,

to extract the sid, you have to use the rex command using a regex like this:

\[sid:(?<sid>[^\]]*)\]

that you can test at https://regex101.com/r/DljBHu/1

You can use this regex in a rex command

your_search
| rex "\[sid:(?<sid>[^\]]*)\]"
| table ...

or in a field extraction [Settings -- Fields -- Field Extractions -- New Field Extration].

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...