Splunk Search

Rex question

garciajbg
Explorer

Hello everyone, I am trying to extract several “NEW” fields from a field and I am having trouble doing so.

The field I am trying to extract from is a default field in an index but for some reason, the field name and its contents are not located in the "_raw" field. So, I am unable to use the built-in Splunk extractor to accomplish what I am trying to do.
The contents of the sourcefield varies as seen below.

  1. sourcefield=/var/log/bash_history/localuser/DOMAIN\first.last.domain
    • I need to extract "localuser" as field1, "DOMAIN" as field 2, and "first.last.domain" as field3.

  2. sourcefield=/var/log/bash_history/DOMAIN\first.last.domain/DOMAIN\first.last.domain
    • I need to extract “DOMAIN” as field2 and “first.last.domain” as field3

Would it make sense to use the first example to extract all fields since both content paths share similar strings with the exception of “localuser”? That way, if the “localuser” field doesn’t exist it would just see it as NULL value?
Any help will be greatly appreciated.

Labels (2)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval sourcefield="/var/log/bash_history/localuser/DOMAIN\first.last.domain" 
| appendpipe 
    [ eval sourcefield="/var/log/bash_history/DOMAIN\first.last.domain/DOMAIN\first.last.domain"] 
| rename COMMENT as "from here, the logic"
| eval tmp1=mvindex(split(sourcefield,"/"),4), tmp2=mvindex(split(sourcefield,"/"),5) 
| eval field1=if(tmp1!=tmp2,tmp1,NULL) 
| eval field2=if(tmp1==tmp2,mvindex(split(tmp1,"\\"),0),NULL)
| eval field3=if(tmp1==tmp2,mvindex(split(tmp1,"\\"),1),NULL)

I think REGEX does not need.

0 Karma

garciajbg
Explorer

@gcusello I am not sure what you are asking. Is the question, how many results can the "field1" potentially have? If so, filed1 should not have more than 4 results (i.e. name1, name2, name3, or name4).

I had something similar to what you posted and I was never able to get the DOMAIN to field to extract. I will try what you posted and I will post my results shortly.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @garciajbg,
the problem is field, because field 2 and 3 are easy to extract, so: there's a rule to identify field1 (e.g. w limited set of values)?

Anyway, to extract the other fields, try this regex:

(?<field2>\w+)\\(?<field3>[^\/]+)$

that you can check at https://regex101.com/r/DaqLjq/1 .

Ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

if the values in field1 are few (four as you said), you could use two regexes:

the one above to extarct field2 and field3

the following to extract field1

\/\w+\/\w+\/\w+\/(?<field1>localuser|user2|user3|user4)/

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...