How to use field transformations in a splunk search instead of transforms.conf ?

[pavanae]

I have the following stanza on the transforms.conf which actually splits commands separated by characters like |, &, ; etc. and extracts arguments in a separate field

[split_and_extract_unix_commands]
SOURCE_KEY = activity
REGEX =((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)
MV_ADD = TRUE

And I have the field extraction for "activity" in props.conf as follows

[syslog]
EXTRACT-syslog_username_command_sudo = (sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)

This actually works well and splits the values of activity field into command and arguments

Now how can I implement the same on a search query and create the fields "command" and "arguments" instead of creating those field extractions on transforms.conf

The following the query I came across so far and not sure what's the stanza in rex for creating the fields "command" and "arguments" which actually splits the "command" field by using the transforms.conf stanza.

sourcetype=syslog
| rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"

Any help would be great.

Thanks in Advance.

[somesoni2 · Accepted solution]

Try these

 sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>(?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"

OR

sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"
| rex field=activity max_match=0 "((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)"

[pavanae]

Thank you @ somesoni. That worked perfect.

[mydog8it]

You pretty much have the answer in your transforms. "Your search"|REGEX _raw=((?[^|&#; ]\/)?(?[^|&#; ]+)( *(?[^&|#;](-exec)|[^&|#;]*))?)

[pavanae]

Thanks for your response @mydog8it . It didn't give me what I'm looking for. It did worked without any error but it just getting the timestamp values under both "command" and "arguments" like may under "command" and the rest of time under "arguments" but I'm actually trying break the values of "activity" field into both "command" and "arguments".

I'm not exactly sure how to tell in rex to apply the field extraction for a specific field. Tried the below but got an error.

 sourcetype=syslog
 | rex field=_raw "(sudo|dzdo).* (?<username>[^\s]+) :.*USER=(?<target_account>\S+).*COMMAND=(?<activity>.+)"
| rex field=_raw "((?<prefix>[^|&#; ]*\/)?(?<command>[^|&#; ]+)( *(?<arguments>[^&|#;]*(-exec)|[^&|#;]*))?)" in activity
| search activity!=null
| table username target_account activity command arguments

error :- Error in 'rex' command: Invalid argument: 'in'