Splunk Search
Highlighted

Modify default field extraction for spaces

Engager

We are successfully ingesting Websense logs into Splunk but the user field is recorded in LDAP context and has spaces. Splunk's default field extraction truncates the user field at the end of the LDAP host, leaving the user context and name undefined. While I can do search-time rex to define that data, I'm thinking it would be better to do this at index so that the Websense app would function as expected and so that we're not custom defining the full variety of records we may receive. Is there way to modify the default extraction to delimit this field properly?

A sample record is:

Jul 3 12:41:10 10.10.2.4 vendor=Websense product=Security productversion=7.8.3 action=permitted severity=1 category=109 user=LDAP://addc1.my.ad.dom OU=Users,OU=Office,DC=my,DC=ad,DC=dom/John Mark Sanders srchost=10.22.70.18 srcport=0 dsthost=www.google.com:80 dstip=74.125.228.81 dstport=80 bytesout=548 bytesin=0 httpresponse=0 httpmethod=GET httpcontenttype=- httpuseragent=Mozilla/4.0(compatible;MSIE8.0;WindowsNT6.1;WOW64;Trident/4.0;SLCC2;.NETCLR2.0.50727;.NETCLR3.5.30729;.NETCLR3.0.30729;MediaCenterPC6.0;.NET4.0C;InfoPath.3) httpproxystatuscode=0 reason=- disposition=1026 policy=RegularUser role=8 duration=0 url=http://www.google.com:80/images/google_favicon_128.png

The rex delims for this would obviously be the text between user= and src_host=

I'm relatively new to Splunk transformations, so I apologize if this is obvious.

Thanks in advance.

0 Karma
Highlighted

Re: Modify default field extraction for spaces

SplunkTrust
SplunkTrust

You could define a Field Extraction (Settings -> Fields) for that sourcetype using this expression:

user=(?<user>.+?)\s+src_host

That'll look for "user=", capture as few chars as possible until it encounters " src_host=".

Check if there are any issues around the automatically extracted partial user value.

View solution in original post

0 Karma