Splunk Search

Splunk Regular Expression

vasuparvatham
New Member

Hello,

alt text

Attached here the list of roles we have. But my regular expression is showing results of only RSI - VPN Users but not all the other roles.

rex "^[^\)\n]*\)\[(?P\w+\s+\-\s+\w+\s+\w+)]"

Can you please help me here?

Entire Query:

index=juniperindex | rex "(?P\w+\s+\d+)\s+(?P\d+:\d+:\d+)\s?+(?P\d+\.\d+\.\d+\.\d+)\s+(?P\d+-\d+-\d+T\d+:\d+:\d+-\d+:\d+)\s+(?P[[:graph:]]+)\s+\w+:\s+\d+-\d+-\d+\s+\d+:\d+:\d+\s+-\s+\w++\s+-\s+\[(?P\d+\.\d+\.\d+\.\d+)\]\s+(?P\w+)\((?P[[:graph:]]+)\)\[\]\s+-\s+(?P.+)"  | rex "^[^\)\n]*\)\[(?P\w+\s+\-\s+\w+\s+\w+)" | rex "^(?:[^'\n]*'){7}(?P\w+)]" | rex "host\s+\'(?P[[:graph:]]+)\'" | rex "address\s+\'(?P[[:graph:]]+)\'" | rex "for\s+user\s+\'(?P[[:alnum:]]+)\'" | rex "reason\s+\'(?P[[:print:]]+)\'"  | rex "^(?:[^'\n]*'){2}\s+(?P\w+)"  | search status=failed OR status=passed | replace "passed" with successful in status | dedup user_name | table  _time IP MAC user_name  status user_group
0 Karma

shivanshu1593
Builder

You can try this:

^(Con.+ess|Pul.+ole|RSI.+|VPN.+ulse|test|Users)

Made a few tweaks with your data here. You can try and test it with more data.

https://regex101.com/r/NFBLP2/1

Let me know if it helps.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

vasuparvatham
New Member

thank you.

Can you please help me with the syntax for creating a tab called "user_group" and include this regular expression?

ex: | rex

Thanks in advance.

0 Karma

shivanshu1593
Builder

Maybe this can help:

| rex field=_raw "(?<user_group>^(Con.+ess|Pul.+ole|RSI.+|VPN.+ulse|test|Users)"
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

vasuparvatham
New Member

i will try this today and come back in case of any queries. thanks lot.

0 Karma

shivanshu1593
Builder

No worries. If it worked, please accept this as the answer, so that it may help others in the future, should they run into a similar kind of issue.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

vasuparvatham
New Member

can you please help me with a single regular expression to cut below format of entries in the log file:

Example:

Consultants Special Access
Contractors Windows Users Special Access
PulseSAMRole
RSI - GIB Users
RSI - IT Desktop Users
RSI - ORA Devtrack
RSI - VPN ArchiveContractor Users
RSI - VPN Contractor Mac Users
RSI - VPN Contractor Users
RSI - VPN Contractor Users(Pulse)
RSI - VPN ITSecurity Users
RSI - VPN Users
test
Users
VPN Contractor Pulse

Many thanks in advance.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...