Hi All,
I am using Splunk Enterprise 7.3.6 and access to my application occurs with ID (can be a number or string with no special characters), email and domain login (like domain-subdomain\xxxx)
I tried to Splunk IFX (Interactive Field Extraction) to extract failed logins which can be ID, email or domain login. But it seems splunk is not able to get all the three via IFX. Since email and domain login contains special characters, it retrieves values until the special character alone. Below are the samples
User login failed: abcde #Extract works
User login failed: 12345 #Extract works
User login failed: abcd@gmail.com #Extract picks till abcd alone
User login failed: mydom-sub\abcde #Extract picks till mydom
How do I include all these above scenarios in one extract using IFX. Any suggestions and advise would be helpful
I have no idea on regex hence I never tried it and it looked better to use IFX who are new to splunk
Thanks
This regex should work, at least with the sample events. You can confirm it using regex101.com.
failed: (?<user>.*)
@richgalloway Thanks for the response. Sample events are similar to what I have posted already hence it would be the same
I tried regex also but not much luck since it always stuck in error only
This regex should work, at least with the sample events. You can confirm it using regex101.com.
failed: (?<user>.*)