Hello,
Attached here the list of roles we have. But my regular expression is showing results of only RSI - VPN Users but not all the other roles.
rex "^[^\)\n]*\)\[(?P\w+\s+\-\s+\w+\s+\w+)]"
Can you please help me here?
Entire Query:
index=juniperindex | rex "(?P\w+\s+\d+)\s+(?P\d+:\d+:\d+)\s?+(?P\d+\.\d+\.\d+\.\d+)\s+(?P\d+-\d+-\d+T\d+:\d+:\d+-\d+:\d+)\s+(?P[[:graph:]]+)\s+\w+:\s+\d+-\d+-\d+\s+\d+:\d+:\d+\s+-\s+\w++\s+-\s+\[(?P\d+\.\d+\.\d+\.\d+)\]\s+(?P\w+)\((?P[[:graph:]]+)\)\[\]\s+-\s+(?P.+)" | rex "^[^\)\n]*\)\[(?P\w+\s+\-\s+\w+\s+\w+)" | rex "^(?:[^'\n]*'){7}(?P\w+)]" | rex "host\s+\'(?P[[:graph:]]+)\'" | rex "address\s+\'(?P[[:graph:]]+)\'" | rex "for\s+user\s+\'(?P[[:alnum:]]+)\'" | rex "reason\s+\'(?P[[:print:]]+)\'" | rex "^(?:[^'\n]*'){2}\s+(?P\w+)" | search status=failed OR status=passed | replace "passed" with successful in status | dedup user_name | table _time IP MAC user_name status user_group
You can try this:
^(Con.+ess|Pul.+ole|RSI.+|VPN.+ulse|test|Users)
Made a few tweaks with your data here. You can try and test it with more data.
https://regex101.com/r/NFBLP2/1
Let me know if it helps.
thank you.
Can you please help me with the syntax for creating a tab called "user_group" and include this regular expression?
ex: | rex
Thanks in advance.
Maybe this can help:
| rex field=_raw "(?<user_group>^(Con.+ess|Pul.+ole|RSI.+|VPN.+ulse|test|Users)"
i will try this today and come back in case of any queries. thanks lot.
No worries. If it worked, please accept this as the answer, so that it may help others in the future, should they run into a similar kind of issue.
can you please help me with a single regular expression to cut below format of entries in the log file:
Example:
Consultants Special Access
Contractors Windows Users Special Access
PulseSAMRole
RSI - GIB Users
RSI - IT Desktop Users
RSI - ORA Devtrack
RSI - VPN ArchiveContractor Users
RSI - VPN Contractor Mac Users
RSI - VPN Contractor Users
RSI - VPN Contractor Users(Pulse)
RSI - VPN ITSecurity Users
RSI - VPN Users
test
Users
VPN Contractor Pulse
Many thanks in advance.