Splunk Search

Regex for field extraction

splunkn
Communicator

I am having a source file with the two below mentioned format. However I need to extract a same field but whose positions differ.
Could anyone help me with appropriate regex?

Jan 21 19:38:53 hostname sudo: pam_unix(sudo:session): session opened for user abc by xyz(uid=0)

Jan 21 19:38:38 hostname sshd[000]: Accepted password for xyz from port 123

Here I need to extract the user "xyz" . Both events belongs to same source. How could write the regex to match the both?

OR do we need to go with Field alias?

Thanks in advance

Tags (2)
0 Karma
1 Solution

pradeepkumarg
Influencer

One way is to extract both differently and then use coalesce function to grab the one that is not NULL

... |  rex "(?i)session opened for user \w+ by (?P<USER1>.\w+)\W"  |  rex "(?i)Accepted password for(?P<USER2>.\w+) from" 
    | eval USER = coalesce(USER1,USER2)

View solution in original post

0 Karma

pradeepkumarg
Influencer

One way is to extract both differently and then use coalesce function to grab the one that is not NULL

... |  rex "(?i)session opened for user \w+ by (?P<USER1>.\w+)\W"  |  rex "(?i)Accepted password for(?P<USER2>.\w+) from" 
    | eval USER = coalesce(USER1,USER2)
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...