Splunk Search

Rex question

garciajbg
Explorer

Hello everyone, I am trying to extract several “NEW” fields from a field and I am having trouble doing so.

The field I am trying to extract from is a default field in an index but for some reason, the field name and its contents are not located in the "_raw" field. So, I am unable to use the built-in Splunk extractor to accomplish what I am trying to do.
The contents of the sourcefield varies as seen below.

  1. sourcefield=/var/log/bash_history/localuser/DOMAIN\first.last.domain
    • I need to extract "localuser" as field1, "DOMAIN" as field 2, and "first.last.domain" as field3.

  2. sourcefield=/var/log/bash_history/DOMAIN\first.last.domain/DOMAIN\first.last.domain
    • I need to extract “DOMAIN” as field2 and “first.last.domain” as field3

Would it make sense to use the first example to extract all fields since both content paths share similar strings with the exception of “localuser”? That way, if the “localuser” field doesn’t exist it would just see it as NULL value?
Any help will be greatly appreciated.

Labels (2)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval sourcefield="/var/log/bash_history/localuser/DOMAIN\first.last.domain" 
| appendpipe 
    [ eval sourcefield="/var/log/bash_history/DOMAIN\first.last.domain/DOMAIN\first.last.domain"] 
| rename COMMENT as "from here, the logic"
| eval tmp1=mvindex(split(sourcefield,"/"),4), tmp2=mvindex(split(sourcefield,"/"),5) 
| eval field1=if(tmp1!=tmp2,tmp1,NULL) 
| eval field2=if(tmp1==tmp2,mvindex(split(tmp1,"\\"),0),NULL)
| eval field3=if(tmp1==tmp2,mvindex(split(tmp1,"\\"),1),NULL)

I think REGEX does not need.

0 Karma

garciajbg
Explorer

@gcusello I am not sure what you are asking. Is the question, how many results can the "field1" potentially have? If so, filed1 should not have more than 4 results (i.e. name1, name2, name3, or name4).

I had something similar to what you posted and I was never able to get the DOMAIN to field to extract. I will try what you posted and I will post my results shortly.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @garciajbg,
the problem is field, because field 2 and 3 are easy to extract, so: there's a rule to identify field1 (e.g. w limited set of values)?

Anyway, to extract the other fields, try this regex:

(?<field2>\w+)\\(?<field3>[^\/]+)$

that you can check at https://regex101.com/r/DaqLjq/1 .

Ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

if the values in field1 are few (four as you said), you could use two regexes:

the one above to extarct field2 and field3

the following to extract field1

\/\w+\/\w+\/\w+\/(?<field1>localuser|user2|user3|user4)/

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...