Splunk Search

Is it possible to strip text out of a field for better reporting

richfoster
Engager

I am looking to strip out some text from a field in my log file and have no knowledge of regex to do it. What I would like is the get "richf" out of the following entry by setting up a field "loguser" then removing "logname" from it. I have lots of other linux machines that use the field "user" and have a diferent format when searching for "richf" in the interactive field editor "user" and "richf" are highlighted and not the logname=richf.

May 30 12:02:58 revmq su: pam_unix(su-l:auth): authentication failure; logname=richf uid=502 euid=0 tty=pts/1 ruser=richf rhost= user=root
May 30 12:02:56 revmq sshd[5165]: pam_unix(sshd:session): session opened for user richf by (uid=0)
May 30 12:02:56 revmq sshd[5165]: Accepted password for richf from 10.77.113.237 port 5718 ssh2

Tags (2)
0 Karma

wpreston
Motivator

Sure, this can be done. Use the rex command followed by a regular expression to extract the fields you need. Try this:

your search or * | rex "(opened\sfor\suser\s|password\sfor\s)(?<User>[^\s]+)" | rex "logname=(?<Logname>[^\s])"

You can see what all is extracted by appending this at the end of the above search: | stats values User Logname. I don't know if it will cover all of your cases for extracting User, but it should work for the ones provided in the question. Another way to get your Logname extraction is to use automatic field extraction since it is in field=value format, but that won't work with your User extraction.

Also, here is a great place to get started learning regular expressions: http://www.regular-expressions.info

I use this website to test my regexes: http://rubular.com/

0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...