Splunk Search

Regex extraction

timbCFCA
Path Finder

I am attempting to extract key value pairs from a data stream with the following syntax.

Successful Logon:     User Name: user     Domain: domain     Logon ID: (0x0,0x1480338F)     Logon Process: etc     Workstation Name:      Logon GUID: {d660922a-0228-f3f5-0acd-2052d7e03d22}     Caller User Name: -     Caller Domain: -     Caller Logon ID: -     Caller Process ID: -     Transited Services: -     Source Network Address: ...     

My transforms.conf contains

[with_colon] 
REGEX = \s\s\s(.*?):\s(.*?)\s\s 
FORMAT = $1::$2 
CLEAN_KEYS = 1 
MV_ADD = 1
REPEAT_MATCH = true

and my props.conf contains

[my_type]
# Derived from windows_snare_syslog
MAX_TIMESTAMP_LOOKAHEAD = 32
TRANSFORMS = syslog-host
REPORT-syslog = syslog-extractions
REPORT-colon = snare_colon
SHOULD_LINEMERGE = False
TIME_FORMAT = %b %d %H:%M:%S

The regular expression works perfectly in my test environment (Notepad++ with the latest regex engine) but not a single new field is extracted. What am I doing wrong?

0 Karma
1 Solution

Ayn
Legend

Looks like a typo in your props.conf? The section in transforms.conf is called with_colon but the transform you're referring to in props.conf is snare_colon.

View solution in original post

0 Karma

Ayn
Legend

Looks like a typo in your props.conf? The section in transforms.conf is called with_colon but the transform you're referring to in props.conf is snare_colon.

0 Karma

timbCFCA
Path Finder

Ayn.. Thanks so much. That was exactly the problem. Over the course of the implementation I changed the name slightly and hadn't updated it here. I now have a few hundred more fields I don't have to enter by hand.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...