Splunk Search

Information extraction

klaudiac
Path Finder

Hi folks,

Hoping you might be able to help.

I've some raw logs coming in and one of the "extracted" fields is a fields with all the system information I need e.g.

Remote Desktop Protocol: OS: Windows 10/Windows Server OS Build: 10.0.18362 Target Name: NACORP NetBIOS Domain Name: NACORP NetBIOS Computer Name: 1234ABC DNS Domain Name: na.corp.xxxxx.com System Time: 2021-12-12 22:55:40.534959 Authorized Use Only - v 041001 This system is for the use of authorized users only.

How do I extract specific pieces from it?  I need NetBIOS Domain Name and Computer Name and System Time

I thought of using a regex but not sure how to build it since NetBIOS Domain Name values can be of different variations e'g one will be NACORP another one will be USON and another wil be NACORP.LOCAL

Similar with the computer name - there's no unified naming convention - it depends on a country we get the logs from. some can have a "-" in the middle, some will have a "." etc.

Any hints and tips on how to tackle it will be more than appreciated!

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @klaudiac,

please try something like this:

| rex field=extracted_field "NetBIOS\s+Domain\s+Name:\s+(?<NetBIOS_Domains_Name>.*)\s+NetBIOS\s+Computer\s+Name:\s+(?<NetBIOS_Computer_Name>.*)\s+DNS.*System\s+Time:\s+(?<System_Time>.*)\s+Authorized"

that you can test at https://regex101.com/r/ZiS0ey/1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...