Splunk Search

REGEX for authentication logs

hartfoml
Motivator

I have authentication logs like below:

,AUTHN_METHOD_FOO,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,username,FIRST,LAST,

I want to use regex to build transform for a field called username and first and last

I had this but it didn't work

rex "(?i)AUTHN_METHOD_*+,*+,*+,*+,*+,(?P<username>[^,]+)"

Any help would be great!!!

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

rex "(?i)AUTHN_METHOD_\w+,.*,(?<username>[^,]+),(?<first>[^,]+),(?<last>[^,]+)"

View solution in original post

somesoni2
Revered Legend

Try this

rex "(?i)AUTHN_METHOD_\w+,.*,(?<username>[^,]+),(?<first>[^,]+),(?<last>[^,]+)"

hartfoml
Motivator

Thanks, I have a problem becasue the \w+ could be one work or several like this "SUCCESS_TEMPORARY_FIXED_TOKENCODE" and the .* for the 4 sets of guid numbers seems odd

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...