Splunk Search

Is there a way to extract fields which is : separated

Hema_Nithya
Explorer

John:x:/home/John:/bin/bash 

 

is there a way to extract the field from above with colon separated.  We have many users in the above format from /etc/passwd 

John - username 

x - passwd 

/home/John - path 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<username>[^:]+):(?<passwd>[^:]+):(?<path>[^:]+)"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<username>[^:]+):(?<passwd>[^:]+):(?<path>[^:]+)"
0 Karma

Hema_Nithya
Explorer

How to deal with the empty fields between . Example there is empty field between passwd and after home directory 

userid:passwd: :/home/John: : 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<username>[^:]*):(?<passwd>[^:]*):(?<path>[^:]*)"
0 Karma

Hema_Nithya
Explorer

Thank you , let me check and update you ! 

0 Karma
Get Updates on the Splunk Community!

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

Unlock Instant Security Insights from Amazon S3 with Splunk Cloud — Try Federated ...

Availability: Must be on Splunk Cloud Platform version 10.1.2507.x to view the free trial banner. If you are ...