Regex for F5 BIG IP ASM logs

[jwalzerpitt]

There is a field - req_status - for F5 Big IP ASM logs and right now when I view the values, I expect to see three:

1. Passed
2. Blocked
3. Alerted

However, when I view the values, I am seeing values that are truncated like as follows:

"pa
"p
"pas
"pass
"passe
"
"passed

Here is a snippet of the log (verbiage before and after the snippet):

.....req_status="passed",resp="Logging rate limit reached".....

I tried using ,req_status=(\"\w+)", for my regex and it looks clean on regex101.com, but not Splunk.

Any suggestions to clean up the regex would be greatly appreciated

Thx

[DavidHourani]

Hi @jwalzerpitt,

The problem is not in the regex but it's with the KV_MODE in props.conf of your sourcetype. It's trying to automatically extract the field and sometimes ends up breaking it if the event if truncated.

Go into your props.conf and change the KV_MODE to none then restart your search head and then try your regex again, should work like a charm.

Cheers,
David

[marycordova]

Please post samples of the full raw log event (sanitized) as well as the current configuration (props.conf probably) for parsing this field.

[abhijeetbandre]

Try below regex .

req_status=\"(?\w+[^\"]),Try below regex and let me know .

req_status=\"(?[^\"]+[^\"])

[jwalzerpitt]

Thx for the two rexes.

Applying the first rex, I get the truncated values

Applying the second rex, I get values other than the three I'm looking for:

May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=

Thx

[koshyk]

Please try

|rex "req_status=\"(?<req_status>[^\"]+)\""

[jwalzerpitt]

Thx for the rex

When I apply it, I'm seeing values other than the three listed:

May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=

and some other variations of that

[koshyk]

please give the whole event as a sample, so we can write the regex for you