Need help with a rex field extraction

[jambajuice]

I have some data that is displaying line breaks as "\n". I'm having problems writing rex commands in searches to strip those out. For example, I have the following:

Linux Kernel 2.4\nLinux Kernel 2.6\n

I would like rex to return:

Linux Kernel 2.4
Linux Kernel 2.6

I've tried things like [\w\s\d.()-\,]+ and [^\]+. I've tried putting (\n) and (\\n) after the (?P<...>) field extraction.

Help?

Sorry to be so noobish.

Craig

[gkanapathy]

If you're doing it at search time using rex in the SplunkWeb interface, you need to quote the \ in the regex, and then you need to quote the quotes themselves. Assuming the field is _raw:

... | rex "s/\\\\n/\\n/g" mode=sed

You would not need to do this nested quoting in a config file. You would probably need to do it in the Unix shell, though you might quote it differently. On the standard Windows cmd shell, the quoting rules are unclear, but you probably don't need to quote \ characters.

[gkanapathy]

oops. that should be rex, not eval.

[jambajuice]

Here is what the raw event looks like:

\nSynopsis :\n\nIt is possible to guess the remote operating system\n\nDescription :\n\nUsing a combination of remote probes (TCP/IP, SMB, HTTP, NTP, SNMP, etc...) \nit is possible to guess the name of the remote operating system in use, and\nsometimes its version\n\nSolution :\n\nN/A\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nRemote operating system : Linux Kernel 2.4\nLinux Kernel 2.6\nConfidence Level : 59\nMethod : SinFP\n\n \nThe remote host is running one of these operating systems : \nLinux Kernel 2.4\nLinux Kernel 2.6\n\n

[jambajuice]

I've tried using the command you sent me and I'm failing to make it work. Here is the search:

sourcetype="nessus" nessus_id=11936 | eval "s/\\n/\n/g" mode=sed | rex field=_raw "(?i)Remote\soperating\ssystem\s:\s(?P[\w\s\\d.()-\,]+)Confidence\sLevel\s:\s(?P\d+)" | rex field=operating_system max_match=10 "(?i)(?P[^\]+)" | table dest_ip,operating_system,confidence