Splunk Search

Problem with rex and stats count

jpvh12345
New Member

I have single-line log entries that come into splunk looking like this:
Apr 1 12:34:09 10.1.9.254 %ASA-4-722051: Group User IP <108.81.41.121> Address <172.31.255.91> assigned to session
Each entry represents a single login.
I would like to have a count of all log entries with individual names that follow in the <> after the "User" phrase. User is not a field defined so it has to be done with a rex or something at search time.
The last thing I've tried is:
| rex field=_raw "User\s(?)" | stats count by _raw
but all I get with this is a listing of the individual log entries.

Tags (1)
0 Karma
1 Solution

marcoscala
Builder

Search something like

Group user ip assignment to session | stats count as "login number"

That's it.

If instead you want to really use "Rex" you can do something like

....| rex "User\s<(?[^>]+)> | stats count(user)

And forget _raw.

Marco

View solution in original post

0 Karma

jpvh12345
New Member

I futzed around with the rex Marco sent and it worked. Just for historical purposes, the rex for this is:
rex "User\s<(?[^>]+)>" | stats count by user
Thanks again.

0 Karma

marcoscala
Builder

good job.
in that way you have the different login for each different user. My stats was counting all events where the field user had a value.

Marco

0 Karma

jpvh12345
New Member

Thank you, but no, I had already tried stats count by user and that didn't work.

0 Karma

linu1988
Champion

you are correct. But you only miss a small thing in count.

|stats count by user

marcoscala
Builder

Search something like

Group user ip assignment to session | stats count as "login number"

That's it.

If instead you want to really use "Rex" you can do something like

....| rex "User\s<(?[^>]+)> | stats count(user)

And forget _raw.

Marco

0 Karma

marcoscala
Builder

sorry folks for some confusion.. I was writing from my iPad and there was some extra capitalization due to autocorrect....
Marco

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...