Splunk not reflecting correct REGEX Grouping

[rgarcia3904]

I am new to splunk and have been trying to set up my first transforms but I am having some issues. I was hoping to get some help.

Here is the scenario:

Given this data:

Time: 05/09-16:32:33.470574
event_ref: 0
22.1.11.254 -> 17.96.40.171 (portscan) TCP Portsweep
Priority Count: 3
Connection Count: 9
IP Count: 12
Scanned IP Range: 17.158.28.47:204.0.4.104
Port/Proto Count: 9
Port/Proto Range: 80:12350

And this transforms.conf

[snortPSVarious]
REGEX=(?m)(\d+.\d+.\d+.\d+)(\s+)(->\s+)(\d+.\d+.\d+.\d+\s+)(.*\R)
FORMAT=snortps_src_ip::$1 snortps_dir::$3 snortps_dst_ip::$4 snortps_type::$5

---

Problem: No matter what I try the snortps_type won't return "(portscan) TCP Portsweep".
It actually matches (in Splunk) the rest of the string. Oddly enough, when I test this SAME regex at:

http://gskinner.com/RegExr/

I would attach a screen shot but apparently I don't have enough "karma". 😉

Any thoughts out there?

Best,
-Roberto

[JSapienza · Accepted solution]

My bad try this one:

EXTRACT-snortps_type = (?im)\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b\s\-\>\s\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b(?P< snortps_type >.*)Priority

[rgarcia3904]

This works just fine! Thanks!
-Roberto

[JSapienza]

OK, I am going to assume that you are trying to do a field extraction. All you need is a props.conf with the following:

[snortPS]
EXTRACT-snortps_type = (\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(\s\-\>\s)(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(?P < snortps_type >.*)

Is this the result you are looking for ?

[rgarcia3904]

No.
The result I need is for snortps_type to have "(portscan) TCP Portsweep" and nothing more.

Thanks for your help!

Best,
Roberto

[JSapienza]

Try something like this:

REGEX = (\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(\s\-\>\s)(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(.*)\
FORMAT = snortps_type::$4

[rgarcia3904]

Unfortunately that does not work. I get the same results as you do on the test site but when I integrate into Splunk and reload the field still contains the whole of the rest of the string.
Could this be a bug in this version of Splunk?
Thanks for your help.
Best,
Roberto