Splunk Search

Strange search results

joonradley
Path Finder

Hi,

I am currently indexing bash history files. The user and other information are encapsulated in the file name when all the history files are collected.

e.g. /install/.log/20100910124129-server1.user1.user4.desktop1.domain.tld.log

I use the following EXTRACT in the props.conf:

EXTRACT-userinfo=/install/\.log/(?<LOGOUT>\d{14})-(?<CMDHOST>[^\.]+)\.(?<USER>[^\.]+)\.(?<EUSER>[^\.]+)\.(?<FORMHOST>\.+)\.log in source

On viewing the results form the search:

index=myindex

Shows all the fields in the field picker with the correct counts. When clicking on one of the fields the search changes to:

Index=myindex CMDHOST =”host1”

Shows “No matching events found”

Index=myindex CMDHOST =”*host1”

List all the events for the CMDHOST

index="myindex" | fields _raw, CMDHOST | search CMDHOST ="host1"

again lists all the events for the specific CMDHOST.

Any ideas?

BTW tested on Splunk 4.1.2 and 4.1.5 on MacOSX, Windows and FreeBSD.

Tags (2)
0 Karma
1 Solution

ziegfried
Influencer

This is because Splunk expects the field value of the CMDHOST field to be part of the raw event (ie. the _raw field). You have two options to make the field-search work:

  • Mark the fields with INDEXED_VALUE=false in fields.conf

fields.conf:

[CMDHOST]
INDEXED_VALUE=false
[LOGOUT]
INDEXED_VALUE=false
...
  • Make the fields derived from the source field indexed

See this on how to configure index-time field extractions: http://www.splunk.com/base/Documentation/latest/Admin/Configureindex-timefieldextraction

View solution in original post

ziegfried
Influencer

This is because Splunk expects the field value of the CMDHOST field to be part of the raw event (ie. the _raw field). You have two options to make the field-search work:

  • Mark the fields with INDEXED_VALUE=false in fields.conf

fields.conf:

[CMDHOST]
INDEXED_VALUE=false
[LOGOUT]
INDEXED_VALUE=false
...
  • Make the fields derived from the source field indexed

See this on how to configure index-time field extractions: http://www.splunk.com/base/Documentation/latest/Admin/Configureindex-timefieldextraction

joonradley
Path Finder

Thank you. This worked.

0 Karma

maverick
Splunk Employee
Splunk Employee

I have not tested this yet myself, but upon first review of your description above, the fact that there is a dash char just before the host name makes me think it has something to do with that.

I would try escaping out that dash in your regex and see if it makes a difference.

EXTRACT-userinfo=/install/.log/(?<LOGOUT>\d{14})-(?<CMDHOST>[^.]+).(?<USER>[^.]+).(?<EUSER>[^.]+).(?<FORMHOST>.+).log

OR try this version of the regex that uses \S+ for the value extraction, since there are no spaces in the event.

EXTRACT-userinfo=/install/.log/(?<LOGOUT>\d{14})-(?<CMDHOST>\S+?).(?<USER>\S+?).(?<EUSER>\S+?).(?<FORMHOST>\S+).log

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...