Splunk Search

How to write regex to extract and index a field enclosed in quotations after a known string?

sadkha
Path Finder

I have a set of logs which wasn't automatically parsed when indexed into Splunk.

I would like to extract a field from the logs, however the Interactive Field Extractor isn't picking up on the pattern. I would like to extract the second group of quotations after the phrase "SAML 2.0" (including the quotes) come up in the logs:

...."SAML 2.0" - - - "11.11.111.1111" "www.yahoo.com"

That's essentially how all of the logs look like. I was wondering how I could tell splunk to only extract the 2nd group of quotes after it sees SAML 2.0?

1 Solution

kml_uvce
Builder

In transforms.conf add:

[stanzaname]
REGEX =  .*"SAML 2.0".*\"(?.*)\".*
FORMAT = fieldname::"$1"
WRITE_META = true

props.conf
Add the following lines to props.conf:

[testlog]
TRANSFORMS-netscreen = stanzaname

fields.conf
Add the following lines to fields.conf:

[fieldname]
INDEXED=true

Restart Splunk for your configu

View solution in original post

kml_uvce
Builder

In transforms.conf add:

[stanzaname]
REGEX =  .*"SAML 2.0".*\"(?.*)\".*
FORMAT = fieldname::"$1"
WRITE_META = true

props.conf
Add the following lines to props.conf:

[testlog]
TRANSFORMS-netscreen = stanzaname

fields.conf
Add the following lines to fields.conf:

[fieldname]
INDEXED=true

Restart Splunk for your configu

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...