Splunk Search

Splunk IFX - Get User with ID as well as Email

parthibansg20
Engager

Hi All,

I am using Splunk Enterprise 7.3.6 and access to my application occurs with ID (can be a number or string with no special characters), email and domain login (like domain-subdomain\xxxx)

I tried to Splunk IFX (Interactive Field Extraction) to extract failed logins which can be ID, email or domain login. But it seems splunk is not able to get all the three via IFX. Since email and domain login contains special characters, it retrieves values until the special character alone. Below are the samples

User login failed: abcde  #Extract works

User login failed: 12345  #Extract works

User login failed: abcd@gmail.com  #Extract picks till abcd alone

User login failed: mydom-sub\abcde  #Extract picks till mydom

How do I include all these above scenarios in one extract using IFX. Any suggestions and advise would be helpful

I have no idea on regex hence I never tried it and it looked better to use IFX who are new to splunk

Thanks

Labels (2)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This regex should work, at least with the sample events.  You can confirm it using regex101.com.

failed: (?<user>.*)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
It's times like this when automation fails and we have to turn to old-fashioned manual configuration. It's time to learn regex. It's not hard.
To start, however, we'll need to see some sample events. Are the messages in your posting ("User login failed: abcd@gmail.com") actual events or just examples?
---
If this reply helps you, Karma would be appreciated.
0 Karma

parthibansg20
Engager

@richgalloway Thanks for the response. Sample events are similar to what I have posted already hence it would be the same

I tried regex also but not much luck since it always stuck in error only

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regex should work, at least with the sample events.  You can confirm it using regex101.com.

failed: (?<user>.*)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...