Splunk Search
Highlighted

Splunk Regular Expression

New Member

Hello,

alt text

Attached here the list of roles we have. But my regular expression is showing results of only RSI - VPN Users but not all the other roles.

rex "^[^\)\n]*\)\[(?P\w+\s+\-\s+\w+\s+\w+)]"

Can you please help me here?

Entire Query:

index=juniperindex | rex "(?P\w+\s+\d+)\s+(?P\d+:\d+:\d+)\s?+(?P\d+\.\d+\.\d+\.\d+)\s+(?P\d+-\d+-\d+T\d+:\d+:\d+-\d+:\d+)\s+(?P[[:graph:]]+)\s+\w+:\s+\d+-\d+-\d+\s+\d+:\d+:\d+\s+-\s+\w++\s+-\s+\[(?P\d+\.\d+\.\d+\.\d+)\]\s+(?P\w+)\((?P[[:graph:]]+)\)\[\]\s+-\s+(?P.+)"  | rex "^[^\)\n]*\)\[(?P\w+\s+\-\s+\w+\s+\w+)" | rex "^(?:[^'\n]*'){7}(?P\w+)]" | rex "host\s+\'(?P[[:graph:]]+)\'" | rex "address\s+\'(?P[[:graph:]]+)\'" | rex "for\s+user\s+\'(?P[[:alnum:]]+)\'" | rex "reason\s+\'(?P[[:print:]]+)\'"  | rex "^(?:[^'\n]*'){2}\s+(?P\w+)"  | search status=failed OR status=passed | replace "passed" with successful in status | dedup user_name | table  _time IP MAC user_name  status user_group
0 Karma
Highlighted

Re: Splunk Regular Expression

New Member

can you please help me with a single regular expression to cut below format of entries in the log file:

Example:

Consultants Special Access
Contractors Windows Users Special Access
PulseSAMRole
RSI - GIB Users
RSI - IT Desktop Users
RSI - ORA Devtrack
RSI - VPN ArchiveContractor Users
RSI - VPN Contractor Mac Users
RSI - VPN Contractor Users
RSI - VPN Contractor Users(Pulse)
RSI - VPN ITSecurity Users
RSI - VPN Users
test
Users
VPN Contractor Pulse

Many thanks in advance.

0 Karma
Highlighted

Re: Splunk Regular Expression

Communicator

You can try this:

^(Con.+ess|Pul.+ole|RSI.+|VPN.+ulse|test|Users)

Made a few tweaks with your data here. You can try and test it with more data.

https://regex101.com/r/NFBLP2/1

Let me know if it helps.

0 Karma
Highlighted

Re: Splunk Regular Expression

New Member

thank you.

Can you please help me with the syntax for creating a tab called "user_group" and include this regular expression?

ex: | rex

Thanks in advance.

0 Karma
Highlighted

Re: Splunk Regular Expression

Communicator

Maybe this can help:

| rex field=_raw "(?<user_group>^(Con.+ess|Pul.+ole|RSI.+|VPN.+ulse|test|Users)"
0 Karma
Highlighted

Re: Splunk Regular Expression

New Member

i will try this today and come back in case of any queries. thanks lot.

0 Karma
Highlighted

Re: Splunk Regular Expression

Communicator

No worries. If it worked, please accept this as the answer, so that it may help others in the future, should they run into a similar kind of issue.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.