Splunk Search
Highlighted

Regular Expression to Extract a username out after matching a Specific String of Characters

Explorer

Hi All,

I am attempting to do a field extraction using regular expression and I am having some trouble. I have the following syslog message below from a test Juniper firewall. The username I am logging in with is jdoe-2fa and I have other users that have usernames as well with "-2fa" in their username. What I am trying to do is create a regular expression that searches for -2fa but extracts the actual full username jdoe-2fa so that I can create a field called user.

Jan 9 07:35:16 192.168.1.254 firewall001: NetScreen device_id=firewall001 [Root]system-warning-00515: Admin user jdoe-2fa/904744 has logged on via SSH from 192.168.1.100:53429 (2018-01-09 15:35:15)

0 Karma
Highlighted

Re: Regular Expression to Extract a username out after matching a Specific String of Characters

Champion

Run anywhere example:

| makeresults | eval _raw="Jan 9 07:35:16 192.168.1.254 firewall001: NetScreen device_id=firewall001 [Root]system-warning-00515: Admin user jdoe-2fa/904744 has logged on via SSH from 192.168.1.100:53429 (2018-01-09 15:35:15)"
| rex "user (?<full_user>(?<no_2fa_user>[^\/]+?)(-2fa)?)\/"
0 Karma
Highlighted

Re: Regular Expression to Extract a username out after matching a Specific String of Characters

SplunkTrust
SplunkTrust

Try this

index=<your_index>   | rex field=_raw “user\s(?<user>[^\/]+)” | search user=*-2fa

Let me know if this helps

View solution in original post

Highlighted

Re: Regular Expression to Extract a username out after matching a Specific String of Characters

Champion

Actually this seems closer to what was asked for. At first I was thinking it was asked to separate the -2fa from the rest of the username, but at second glance that doesn’t appear to be the case.

0 Karma
Highlighted

Re: Regular Expression to Extract a username out after matching a Specific String of Characters

SplunkTrust
SplunkTrust

No worries happens 🙂 You are doing quite well .conf18 pass for this month is mostly yours !

0 Karma
Highlighted

Re: Regular Expression to Extract a username out after matching a Specific String of Characters

Champion

Hopefully we'll both get to go and enjoy some beverages!

It's basically this month or bust for me. They'll put me back to work next month, so I won't have nearly as much time to post on answers.

0 Karma
Highlighted

Re: Regular Expression to Extract a username out after matching a Specific String of Characters

SplunkTrust
SplunkTrust

Yeah I hope so all the best !

0 Karma
Highlighted

Re: Regular Expression to Extract a username out after matching a Specific String of Characters

Explorer

I get the following message

Error in 'SearchParser': Missing a search command before '^'. Error at position '55' of search query 'search index="indexname" | rex field=_raw “user\s(?[^\/]+)” |}'.

0 Karma
Highlighted

Re: Regular Expression to Extract a username out after matching a Specific String of Characters

SplunkTrust
SplunkTrust

What query are you running?put it in 101010 sample code

0 Karma
Highlighted

Re: Regular Expression to Extract a username out after matching a Specific String of Characters

Champion

Your double quotes came across wrong.

| rex field=_raw "user\s(?<user>[^\/]+)"
0 Karma