Splunk Search

Splunk not reflecting correct REGEX Grouping

rgarcia3904
New Member

I am new to splunk and have been trying to set up my first transforms but I am having some issues. I was hoping to get some help.

Here is the scenario:

Given this data:

Time: 05/09-16:32:33.470574
event_ref: 0
22.1.11.254 -> 17.96.40.171 (portscan) TCP Portsweep
Priority Count: 3
Connection Count: 9
IP Count: 12
Scanned IP Range: 17.158.28.47:204.0.4.104
Port/Proto Count: 9
Port/Proto Range: 80:12350

And this transforms.conf

[snortPSVarious]
REGEX=(?m)(\d+.\d+.\d+.\d+)(\s+)(->\s+)(\d+.\d+.\d+.\d+\s+)(.*\R)
FORMAT=snortps_src_ip::$1 snortps_dir::$3 snortps_dst_ip::$4 snortps_type::$5


Problem: No matter what I try the snortps_type won't return "(portscan) TCP Portsweep".
It actually matches (in Splunk) the rest of the string. Oddly enough, when I test this SAME regex at:

http://gskinner.com/RegExr/

I would attach a screen shot but apparently I don't have enough "karma". 😉

Any thoughts out there?

Best,
-Roberto

0 Karma
1 Solution

JSapienza
Contributor

My bad try this one:

EXTRACT-snortps_type = (?im)\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b\s\-\>\s\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b(?P< snortps_type >.*)Priority

alt text

View solution in original post

JSapienza
Contributor

My bad try this one:

EXTRACT-snortps_type = (?im)\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b\s\-\>\s\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b(?P< snortps_type >.*)Priority

alt text

rgarcia3904
New Member

This works just fine! Thanks!
-Roberto

0 Karma

JSapienza
Contributor

OK, I am going to assume that you are trying to do a field extraction. All you need is a props.conf with the following:

[snortPS]
EXTRACT-snortps_type = (\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(\s\-\>\s)(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(?P < snortps_type >.*)

Is this the result you are looking for ?

alt text

0 Karma

rgarcia3904
New Member

No.
The result I need is for snortps_type to have "(portscan) TCP Portsweep" and nothing more.

Thanks for your help!

Best,
Roberto

0 Karma

JSapienza
Contributor

Try something like this:

REGEX = (\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(\s\-\>\s)(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(.*)\
FORMAT = snortps_type::$4

alt text

0 Karma

rgarcia3904
New Member

Unfortunately that does not work. I get the same results as you do on the test site but when I integrate into Splunk and reload the field still contains the whole of the rest of the string.
Could this be a bug in this version of Splunk?
Thanks for your help.
Best,
Roberto

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...