Splunk Search

Missing Event details when trying to Extract Fields from an Active Directory event

mpatnode
Path Finder

I have the following raw AD event which I can see from my search:

08/16/2010 12:55:56.0110
dcName=w2k3r2.demo.dev
admonEventType=Update
Names:
    objectCategory=CN=Service-Connection-Point,CN=Schema,CN=Configuration,DC=demo,DC=dev
    name=bsmith
    displayName=$CimsUserVersion2
    distinguishedName=CN=bsmith,CN=Users,CN=default,CN=Zones,CN=Centrify,CN=Program Data,DC=demo,DC=dev
    cn=bsmith
Object Details:
    objectGUID=cffb0829-0642-134c-2ef1-f03cc696e10b
    whenChanged=20100816195556.0Z
    whenCreated=20070906020209.0Z
    objectClass=top|leaf|connectionPoint|serviceConnectionPoint
Event Details:
    uSNChanged=127046
    uSNCreated=14129
    instanceType=4
Additional Details:
    keywords=foo:1111|bar:3333|too:3333
    showInAdvancedViewOnly=TRUE

Whenever I try to use the "Extact Fields" UI, the event is truncated after "Event Details" in the "Sample events" frame. What's preventing me from seeing the entire event?

1 Solution

carasso
Splunk Employee
Splunk Employee

In order to prevent the limited screen real estate from exploding, sample events are truncated at 15 lines (with at most 100 events). I have filed a request for improvement.

From the standard search view, you can still manually test out a regex with the 'rex' search command, and when it works, manually add that regex to your source or sourcetype from the Manager (i.e., Manager » Fields » Field extractions)

View solution in original post

carasso
Splunk Employee
Splunk Employee

In order to prevent the limited screen real estate from exploding, sample events are truncated at 15 lines (with at most 100 events). I have filed a request for improvement.

From the standard search view, you can still manually test out a regex with the 'rex' search command, and when it works, manually add that regex to your source or sourcetype from the Manager (i.e., Manager » Fields » Field extractions)

carasso
Splunk Employee
Splunk Employee

unfortunately, no.

0 Karma

mpatnode
Path Finder

Well that explains that. I did figure out how to use 'rex' as a work around. The next question is can I do dynamic field name generation the same way Splunk does? Something like this:

sourcetype="ActiveDirectory" keywords=* | rex field=_raw "keywords=(?<_KEY_1>[a-z]):(?<_VALUE_1>[0-9])

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...