Splunk Search

Regex for two similar statements to put in transforms.conf ?

Communicator

Hello, thanks for everyones assistance on MVADD=True response on my last question regarding
multivalued pairs.. Now I have the result of a MV
ADD=True below. Very cleanly they are seperated by 1 & 2 below.

1)newuser
2)original
user

Problem I am having now is to be able to write a regex with field seperators for the two blocks below. Knowing the data inside the fields might change, the field names should not.
Would anyone be able to assist?

Thank You in advance
Daniel MacGillivray

newuser=[userid:[BOBSMZSTruck3rdlnsupp1] firstname:[Truck3rdlnsupp1] lastname:[LN] email:[] certdn:[] properties:[[name=ContactID isset=false], [name=ctscPasswordResetAttempts isset=false], [name=ctscSecretQuestionAnswer isset=false]] accountstartdate:[Mar 12, 2014 6:08:47 PM] accountexpirydate:[Jan 1, 4712 6:08:47 PM] islockedout:[false] isactive:[true] passwordexpirydate:[Aug 14, 2014 11:59:26 AM] admin_group:[Person User Admin Group] ispublic:[true]]

originaluser=[userid:[BOBSMZSTruck3rdlnsupp1] firstname:[Truck3rdlnsupp1] lastname:[LN] email:[] certdn:[] properties:[[name=ContactID isset=false], [name=ctscPasswordResetAttempts isset=false], [name=ctscSecretQuestionAnswer isset=false]] accountstartdate:[Mar 12, 2014 6:08:47 PM] accountexpirydate:[Jan 1, 4712 6:08:47 PM] islockedout:[true] isactive:[false] passwordexpirydate:[Aug 6, 2014 6:02:47 PM] admin_group:[Person User Admin Group] ispublic:[true]]

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

This should get you started.

[\s\S]*userid:\[(?<userid>[\s\S]+)] firstname:\[(?<firstname>[\s\S]+)] lastname:\[(?<lastname>[\s\S]+)] 

Put it into RegExr along with your sample events and you should be able to finish your regex string in short order.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

This should get you started.

[\s\S]*userid:\[(?<userid>[\s\S]+)] firstname:\[(?<firstname>[\s\S]+)] lastname:\[(?<lastname>[\s\S]+)] 

Put it into RegExr along with your sample events and you should be able to finish your regex string in short order.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Yes, this string should work in a REGEX statement in your transforms.conf file or in a rex search statement.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Communicator

Delayed thank you !!

0 Karma

Communicator

Hi Rich, Thanks for the help on this. So I should be able to use this as a sample in the transforms ? Or inside the regex extractor tool in Splunk. Either way, thank you.

Daniel

0 Karma