Splunk Search

How to use field transformations in a splunk search instead of transforms.conf ?

pavanae
Builder

I have the following stanza on the transforms.conf which actually splits commands separated by characters like |, &, ; etc. and extracts arguments in a separate field

[split_and_extract_unix_commands]
SOURCE_KEY = activity
REGEX =((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)
MV_ADD = TRUE

And I have the field extraction for "activity" in props.conf as follows

[syslog]
EXTRACT-syslog_username_command_sudo = (sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)

This actually works well and splits the values of activity field into command and arguments

Now how can I implement the same on a search query and create the fields "command" and "arguments" instead of creating those field extractions on transforms.conf

The following the query I came across so far and not sure what's the stanza in rex for creating the fields "command" and "arguments" which actually splits the "command" field by using the transforms.conf stanza.

sourcetype=syslog
| rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"

Any help would be great.

Thanks in Advance.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try these

 sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>(?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"

OR

sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"
| rex field=activity max_match=0 "((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try these

 sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>(?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"

OR

sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"
| rex field=activity max_match=0 "((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"
0 Karma

pavanae
Builder

Thank you @ somesoni. That worked perfect.

0 Karma

mydog8it
Builder

You pretty much have the answer in your transforms. "Your search"|REGEX _raw=((?[^|&#; ]\/)?(?[^|&#; ]+)( *(?[^&|#;](-exec)|[^&|#;]*))?)

0 Karma

pavanae
Builder

Thanks for your response @mydog8it . It didn't give me what I'm looking for. It did worked without any error but it just getting the timestamp values under both "command" and "arguments" like may under "command" and the rest of time under "arguments" but I'm actually trying break the values of "activity" field into both "command" and "arguments".

I'm not exactly sure how to tell in rex to apply the field extraction for a specific field. Tried the below but got an error.

 sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"
| rex field=_raw "((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)" in activity
| search activity!=null
| table username target_account activity command arguments

error :- Error in 'rex' command: Invalid argument: 'in'

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...