Splunk Search

Regex for two similar statements to put in transforms.conf ?

dmacgillivray
Communicator

Hello, thanks for everyones assistance on MV_ADD=True response on my last question regarding
multivalued pairs.. Now I have the result of a MV_ADD=True below. Very cleanly they are seperated by 1 & 2 below.

1)new_user
2)original_user

Problem I am having now is to be able to write a regex with field seperators for the two blocks below. Knowing the data inside the fields might change, the field names should not.
Would anyone be able to assist?

Thank You in advance
Daniel MacGillivray

new_user=[userid:[BOBS_MZS_Truck3rdlnsupp1] firstname:[Truck3rdlnsupp1] lastname:[LN] email:[] certdn:[] properties:[[name=ContactID isset=false], [name=ctscPasswordResetAttempts isset=false], [name=ctscSecretQuestionAnswer isset=false]] account_start_date:[Mar 12, 2014 6:08:47 PM] account_expiry_date:[Jan 1, 4712 6:08:47 PM] islockedout:[false] isactive:[true] passwordexpiry_date:[Aug 14, 2014 11:59:26 AM] admin_group:[Person User Admin Group] ispublic:[true]]

original_user=[userid:[BOBS_MZS_Truck3rdlnsupp1] firstname:[Truck3rdlnsupp1] lastname:[LN] email:[] certdn:[] properties:[[name=ContactID isset=false], [name=ctscPasswordResetAttempts isset=false], [name=ctscSecretQuestionAnswer isset=false]] account_start_date:[Mar 12, 2014 6:08:47 PM] account_expiry_date:[Jan 1, 4712 6:08:47 PM] islockedout:[true] isactive:[false] passwordexpiry_date:[Aug 6, 2014 6:02:47 PM] admin_group:[Person User Admin Group] ispublic:[true]]

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

[\s\S]*userid:\[(?<userid>[\s\S]+)] firstname:\[(?<firstname>[\s\S]+)] lastname:\[(?<lastname>[\s\S]+)] 

Put it into RegExr along with your sample events and you should be able to finish your regex string in short order.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

[\s\S]*userid:\[(?<userid>[\s\S]+)] firstname:\[(?<firstname>[\s\S]+)] lastname:\[(?<lastname>[\s\S]+)] 

Put it into RegExr along with your sample events and you should be able to finish your regex string in short order.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, this string should work in a REGEX statement in your transforms.conf file or in a rex search statement.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dmacgillivray
Communicator

Delayed thank you !!

0 Karma

dmacgillivray
Communicator

Hi Rich, Thanks for the help on this. So I should be able to use this as a sample in the transforms ? Or inside the regex extractor tool in Splunk. Either way, thank you.

Daniel

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...