Splunk Search

Repeating regular expression

clymbouris
Path Finder

I have an Access List input that looks like this

"|ALLOW-LABS.LOCAL\Accounting_FS_Access-0x1301ff-OI|CI|0=GenericRead|0=GenericWrite|0=GenericExecute|0=GenericAll|0=SystemSecurity|1=Synchronize|0=WriteOwner|0=WriteDAC|1=ReadControl|1=Delete|1=WriteAttributes|1=ReadAttributes|1=DeleteChild|1=Execute|1=WriteEA|1=ReadEA|1=Append|1=Write|1=Read|
|ALLOW-LABS.LOCAL\FS_Admin-0x1f01ff-OI|CI|0=GenericRead|0=GenericWrite|0=GenericExecute|0=GenericAll|0=SystemSecurity|1=Synchronize|1=WriteOwner|1=WriteDAC|1=ReadControl|1=Delete|1=WriteAttributes|1=ReadAttributes|1=DeleteChild|1=Execute|1=WriteEA|1=ReadEA|1=Append|1=Write|1=Read|"

This comes as one event in Splunk and anything after |ALLOW is repeated as many times as there are groups defined in the ACL (so unknown number of repeats).

What I'd like to achieve is to extract and format the results in a way that groups are separated from each other.

___ROW1___
Group = LABS.LOCAL\Accounting_FS_Access
GenericRead = 0
GenericWrite = 0
...
Read=1

___ROW2___
Group = LABS.LOCAL\FS_Admin
GenericRead=1
GenericWrite=1
...
Read=1

...
___ROW7___
Group = aGroup
...

I can hit the results by repeating the regex but the output is not the one desired since I'm having multiple Group fields in the event. What I'd like is for a way to separate Group1, Group2, Group3.

rex max_match=99 field=ACL  "\|(ALLOW-(?<Group>.*?)-\w+-\w{2}|\w{2}\|(?<SACL_Fail_GenericRead>[01])\=GenericRead\|(?<SACL_Fail_GenericWrite>[01])\=GenericWrite\|(?<SACL_Fail_GenericExecute>[01])\=GenericExecute\|(?<SACL_Fail_GenericAll>[01])\=GenericAll\|......\|ALLOW-(?<Group>.*?)-\w+-\w{2}|\w{2}\|(?<SACL_Fail_GenericRead>[01])..."

Maybe I'm going the wrong way about this? I've been going around this for days. Any help would be much appreciated.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

When you use a max_match value other than 1 your matching fields will be multi-valued. Use the mvexpand command to separate the results into mutliple fields.

I modified your regex string slightly to work with your sample data in regex101.com.

\|(?:ALLOW-(?<Group>.*?)-\w+-\w{2}|\w{2}\|(?<SACL_Fail_GenericRead>[01])\=GenericRead\|(?<SACL_Fail_GenericWrite>[01])\=GenericWrite\|(?<SACL_Fail_GenericExecute>[01])\=GenericExecute\|(?<SACL_Fail_GenericAll>[01])\=GenericAll\|...)*
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...