Splunk Search

Regex replace field text

g_paternicola
Path Finder

Hello everyone,

I was wondering if this kind of search is possible. I want to replace the text from my search which looks like this:

eventtype=zyxel_user sourcetype="zyxel-fw" msg="Failed login attempt to Device from *"
| stats count by msg
| rex field=msg mode=sed "s/'Failed login attempt to Device from ssh (incorrect password or inexistent username)'/SSH/g"

Basically, I want to get instead of this long string  (Failed login attempt to Device.....) just SSH, so I can create a Pie Chart with this information. 

Is that possible?

Thank you very much for helping me!

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @g_paternicola,

why didn't you  try your search? it seems to be almost correct:

you have only to escape special chars as ():

eventtype=zyxel_user sourcetype="zyxel-fw" msg="Failed login attempt to Device from *"
| stats count by msg
| rex field=msg mode=sed "s/Failed login attempt to Device from ssh \(incorrect password or inexistent username\)/SSH/g"

You could also explore the replace command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Replace)

Ciao.

Giuseppe

View solution in original post

0 Karma

g_paternicola
Path Finder

Hi Giuseppe, my name is also Giuseppe 🙂

I didn't thought about search, thank you! Ohh man, I tried to escape, but I put just one \ at the beginning and not also at the end. 

Just in case I have more of this kind of strings, do I also have to put for each one (e.g. FTP, HTTP, etc..) a different sed command?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Giuseppe,

it's a pleasure to know you!

Anyway, if you have to replace many strings, you could create a lookup containing all these pairs for transformations and use it with the lookup command.

I don't like it, but you could also create an automatic lookup so everytime  you have there strings they are automatically changed.

Ciao Giuseppe

P.S.: if you're italian, there's finally a Splunk User Group also in Italy;

Karma Points are appreciated ;-).

g_paternicola
Path Finder

Yes, I could use a lookup command but for now I'm gonna use the replace command :). But in the future if the results are gonna be bigger and bigger with more than only ssh, ftp and http, then yes, I will use the lookup command in order to automate it... thank you!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @g_paternicola,

why didn't you  try your search? it seems to be almost correct:

you have only to escape special chars as ():

eventtype=zyxel_user sourcetype="zyxel-fw" msg="Failed login attempt to Device from *"
| stats count by msg
| rex field=msg mode=sed "s/Failed login attempt to Device from ssh \(incorrect password or inexistent username\)/SSH/g"

You could also explore the replace command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Replace)

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...