Splunk Search

Splunk not reflecting correct REGEX Grouping

New Member

I am new to splunk and have been trying to set up my first transforms but I am having some issues. I was hoping to get some help.

Here is the scenario:

Given this data:

Time: 05/09-16:32:33.470574
event_ref: 0
22.1.11.254 -> 17.96.40.171 (portscan) TCP Portsweep
Priority Count: 3
Connection Count: 9
IP Count: 12
Scanned IP Range: 17.158.28.47:204.0.4.104
Port/Proto Count: 9
Port/Proto Range: 80:12350

And this transforms.conf

[snortPSVarious]
REGEX=(?m)(\d+.\d+.\d+.\d+)(\s+)(->\s+)(\d+.\d+.\d+.\d+\s+)(.*\R)
FORMAT=snortps_src_ip::$1 snortps_dir::$3 snortps_dst_ip::$4 snortps_type::$5


Problem: No matter what I try the snortps_type won't return "(portscan) TCP Portsweep".
It actually matches (in Splunk) the rest of the string. Oddly enough, when I test this SAME regex at:

http://gskinner.com/RegExr/

I would attach a screen shot but apparently I don't have enough "karma". 😉

Any thoughts out there?

Best,
-Roberto

0 Karma
1 Solution

Contributor

My bad try this one:

EXTRACT-snortps_type = (?im)\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b\s\-\>\s\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b(?P< snortps_type >.*)Priority

alt text

View solution in original post

Contributor

My bad try this one:

EXTRACT-snortps_type = (?im)\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b\s\-\>\s\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b(?P< snortps_type >.*)Priority

alt text

View solution in original post

New Member

This works just fine! Thanks!
-Roberto

0 Karma

Contributor

OK, I am going to assume that you are trying to do a field extraction. All you need is a props.conf with the following:

[snortPS]
EXTRACT-snortps_type = (\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(\s\-\>\s)(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(?P < snortps_type >.*)

Is this the result you are looking for ?

alt text

0 Karma

New Member

No.
The result I need is for snortps_type to have "(portscan) TCP Portsweep" and nothing more.

Thanks for your help!

Best,
Roberto

0 Karma

Contributor

Try something like this:

REGEX = (\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(\s\-\>\s)(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(.*)\
FORMAT = snortps_type::$4

alt text

0 Karma

New Member

Unfortunately that does not work. I get the same results as you do on the test site but when I integrate into Splunk and reload the field still contains the whole of the rest of the string.
Could this be a bug in this version of Splunk?
Thanks for your help.
Best,
Roberto

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!