Splunk Search
Highlighted

Regex for F5 BIG IP ASM logs

Motivator

There is a field - req_status - for F5 Big IP ASM logs and right now when I view the values, I expect to see three:

  1. Passed
  2. Blocked
  3. Alerted

However, when I view the values, I am seeing values that are truncated like as follows:

"pa
"p
"pas
"pass
"passe
"
"passed

Here is a snippet of the log (verbiage before and after the snippet):

.....req_status="passed",resp="Logging rate limit reached".....

I tried using ,req_status=(\"\w+)", for my regex and it looks clean on regex101.com, but not Splunk.

Any suggestions to clean up the regex would be greatly appreciated

Thx

0 Karma
Highlighted

Re: Regex for F5 BIG IP ASM logs

Super Champion

Please try

|rex "req_status=\"(?<req_status>[^\"]+)\""
0 Karma
Highlighted

Re: Regex for F5 BIG IP ASM logs

Motivator

Thx for the rex

When I apply it, I'm seeing values other than the three listed:

May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=

and some other variations of that

0 Karma
Highlighted

Re: Regex for F5 BIG IP ASM logs

Super Champion

please give the whole event as a sample, so we can write the regex for you

0 Karma
Highlighted

Re: Regex for F5 BIG IP ASM logs

New Member

Try below regex .

req_status=\"(?\w+[^\"]),Try below regex and let me know .

req_status=\"(?[^\"]+[^\"])

0 Karma
Highlighted

Re: Regex for F5 BIG IP ASM logs

Motivator

Thx for the two rexes.

Applying the first rex, I get the truncated values

Applying the second rex, I get values other than the three I'm looking for:

May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=

Thx

0 Karma
Highlighted

Re: Regex for F5 BIG IP ASM logs

SplunkTrust
SplunkTrust

Please post samples of the full raw log event (sanitized) as well as the current configuration (props.conf probably) for parsing this field.

0 Karma
Highlighted

Re: Regex for F5 BIG IP ASM logs

SplunkTrust
SplunkTrust

Hi @jwalzerpitt,

The problem is not in the regex but it's with the KV_MODE in props.conf of your sourcetype. It's trying to automatically extract the field and sometimes ends up breaking it if the event if truncated.

Go into your props.conf and change the KV_MODE to none then restart your search head and then try your regex again, should work like a charm.

Cheers,
David

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.