Splunk Search

REGEX help .. I am still learning ....

Stephen11
Explorer

To all:

Still learning about REGEX ...  I looked at RUBULAR.COM and REFEX101.com to figure out how to pull out the Users ids...   In the example below need to get 4 User Ids out ...   I matched on single quote ' - however not able to get  the 4 ids in one swoop ... any suggestions?  Its just not that easy... 

Watched a couple of Youtubes on regex ... just not that all intuitive when condition are a little bit more tricky. appreciate any help I can get.

 

Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

With your example this seems to work.

index=_internal
| head 1
| eval _raw = "Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx"
| rename COMMENT AS "previous set example data, next do the regex"
| rex max_match=0  "Last usernames used in login requests are:\s(?<NamesAll>[^\.]+)"
| rex max_match=0 field=NamesAll "([',\s\.])+(?<Names>[^']+)"

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

With your example this seems to work.

index=_internal
| head 1
| eval _raw = "Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx"
| rename COMMENT AS "previous set example data, next do the regex"
| rex max_match=0  "Last usernames used in login requests are:\s(?<NamesAll>[^\.]+)"
| rex max_match=0 field=NamesAll "([',\s\.])+(?<Names>[^']+)"

r. Ismo 

thambisetty
SplunkTrust
SplunkTrust

Can you share sample event?

the example you shared is not clear.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...