Splunk Search

Need to extract required fields using rex command

rakesh44
Communicator

Hi Friends

I am trying to extract required field from events using rex command. Can someone please help me, logs are given in attached doc.

I am new to rex command , Once i get below rex command then easy to understand

Below are fields need to extract

Kernel Audit Begin, Kernel Begin,pam_unix Begin,Postfix Begin,-SSHD Begin,Sudo (secure-log) Begin,Disk Space Begin

Tags (2)
0 Karma
1 Solution

gcusello
Legend

Hi rakesh44,
let mi know: do you want to extract the following fields?

  • TimeStamp
  • Date Range Processed
  • Detail Level of Output
  • Type of Output/Format
  • Logfiles for Host

If these are the fields to extract from the example you shared, try to use the following regex

Processing Initiated: (?<TimeStamp>\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.*Date Range Processed:\s+yesterday\s+\(\s+(?<Date_Range>[^ ]*)\s+.*\s+.*\s+Detail Level of Output:(?<Level_of_input>[^ ]*)\s+Type of Output\/Format:\s+(?<Type>.*)\s*Logfiles for Host: (?<Logfile>[^ ]*)\s+\#

You can test it at https://regex101.com/r/JNMRCz/1

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi rakesh44,
let mi know: do you want to extract the following fields?

  • TimeStamp
  • Date Range Processed
  • Detail Level of Output
  • Type of Output/Format
  • Logfiles for Host

If these are the fields to extract from the example you shared, try to use the following regex

Processing Initiated: (?<TimeStamp>\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.*Date Range Processed:\s+yesterday\s+\(\s+(?<Date_Range>[^ ]*)\s+.*\s+.*\s+Detail Level of Output:(?<Level_of_input>[^ ]*)\s+Type of Output\/Format:\s+(?<Type>.*)\s*Logfiles for Host: (?<Logfile>[^ ]*)\s+\#

You can test it at https://regex101.com/r/JNMRCz/1

Bye.
Giuseppe

0 Karma

rakesh44
Communicator

Thanks Gcusello , it worked for me rest I would create it

Processing Initiated: (?\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.Date Range Processed:\s+yesterday\s+(\s+(?[^ ])\s+.\s+.\s+Detail Level of Output:(?[^ ])\s+Type of Output\/Format:\s+(?.)\s*Logfiles for Host: (?[^ ]*)\s+#

0 Karma

gcusello
Legend

Good!
if you're satisfied of this answer, please accept and/or upvote it.
At the next time.
Bye.
Giuseppe

0 Karma

vishaltaneja070
Motivator

can you give me the sample value of extraction required for Kernel Audit Begin?

0 Karma

rakesh44
Communicator

I have to prepare dashboard for each field as mentioned, hence need all values of fields.
Kernel Audit Begin : Nee all values of field

0 Karma

rakesh44
Communicator

Unmatched Entries (Only first 100 out of 127 are printed)
dispatch err (pipe full) event lost
dispatch error reporting limit reached - ending report notification.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...