Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Regex not working as expected
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Regex not working as expected
For one of the Security usecase, we need to extract Group Memberships from the Domain. The trickier part is some of the Group Memberships doesnt have domain name in front of it.
I am attaching the Regex link which is working fine on Regex101-
https://regex101.com/r/X2YAAd/1
but for some strange reasons, when i use the same regex on Splunk its not working.
This is to extract Group membership on EventCode=4627
Could anyone help me here..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you elaborate what you mean by "same regex is not working on Splunk"?
One problem may be that you are not using any names for the groups, so Splunk does not know what to name the field.
Also, if you need multiple matches, try using the max_match option.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Always set the RegEx engine to Python. Also try to set (?ms) in front, that should do.
Skalli
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ahh.. i have always used PCRE. When I have changed to python its blank.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The https://regex101.com/r/X2YAAd/1 of your original post works for me when adding (?ms) at the beginning and using Python. Did you try that in Splunk?
Skalli
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello I have tried with the capturing group and still no luck
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
