Splunk Search

How to use field transformations in a splunk search instead of transforms.conf ?

pavanae
Builder

I have the following stanza on the transforms.conf which actually splits commands separated by characters like |, &, ; etc. and extracts arguments in a separate field

[split_and_extract_unix_commands]
SOURCE_KEY = activity
REGEX =((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)
MV_ADD = TRUE

And I have the field extraction for "activity" in props.conf as follows

[syslog]
EXTRACT-syslog_username_command_sudo = (sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)

This actually works well and splits the values of activity field into command and arguments

Now how can I implement the same on a search query and create the fields "command" and "arguments" instead of creating those field extractions on transforms.conf

The following the query I came across so far and not sure what's the stanza in rex for creating the fields "command" and "arguments" which actually splits the "command" field by using the transforms.conf stanza.

sourcetype=syslog
| rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"

Any help would be great.

Thanks in Advance.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try these

 sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>(?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"

OR

sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"
| rex field=activity max_match=0 "((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try these

 sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>(?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"

OR

sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"
| rex field=activity max_match=0 "((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"
0 Karma

pavanae
Builder

Thank you @ somesoni. That worked perfect.

0 Karma

mydog8it
Builder

You pretty much have the answer in your transforms. "Your search"|REGEX _raw=((?[^|&#; ]\/)?(?[^|&#; ]+)( *(?[^&|#;](-exec)|[^&|#;]*))?)

0 Karma

pavanae
Builder

Thanks for your response @mydog8it . It didn't give me what I'm looking for. It did worked without any error but it just getting the timestamp values under both "command" and "arguments" like may under "command" and the rest of time under "arguments" but I'm actually trying break the values of "activity" field into both "command" and "arguments".

I'm not exactly sure how to tell in rex to apply the field extraction for a specific field. Tried the below but got an error.

 sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"
| rex field=_raw "((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)" in activity
| search activity!=null
| table username target_account activity command arguments

error :- Error in 'rex' command: Invalid argument: 'in'

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...