Splunk Search

User Name field extraction - Strip DOMAIN in username

pjohnson1
Path Finder

I have a field extraction which extracts the User Name. Some users will authenticate with their user name, but some will also pre-fix it by the domain.

How can I strip out the domain in the field extraction if the user includes the domain to authenticate?

username=john.doe
username=domain\john.doe

I referred to this https://answers.splunk.com/answers/172242/how-to-use-rex-to-remove-the-domain-from-the-user.html , but the extraction will only extract those user names pre-fixed by domain.

Thanks.

0 Karma

southeringtonp
Motivator

You can modify your field extraction logic pull out both the user and domain, and allow the domain to be skipped if not present.

The sample below will extract three fields. username will contain the full results, user_domain will contain "domain" in second example above, and will be blank for the first. user will contain john.doe for both examples you gave.

Put the following into your transforms.conf:

[user-with-domain]
REGEX = username=((?:([^\\]+)\\)?(\S+))
FORMAT = username:$1 user_domain::$2 user::$3

And activate it via props.conf:

  [mysourcetype]
  REPORT-user = user-with-domain

andresito123
Communicator

I have tried this workaround but it seems that it doesn't work all the time.

I have 4 sourcetypes (for Sophos Endpoint logs) and I have created this configuration for all of them at the same files (local folder of Splunk_TA_sophos app).

It seems that it works for the three of them and not for the forth. Any ideas why this is happens?

Thanks!

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=username mode=sed "s/[^\\]*[\\]//"
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi pjohnson1,

try this crazy regex

your base search here | rex "(?:=(?!\w+\\)|(?<!=)\\)(?<user>\S+)" | ...

This will search for a = not followed by a word character and a \ or a \ not leaded by a = and takes in any non whitespace character as field user - tested and working on http://regex101.com and you will get a better explanation there as well 🙂

Hope this helps ...

cheers, MuS

0 Karma

pjohnson1
Path Finder

Hi MuS,

Thanks for the comment.

I tried:

tag=authentication eventtype="aruba-user-authenticated" | rex "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"

But it matches

username=john.doe

but fails

username=domain\john.doe
0 Karma

MuS
SplunkTrust
SplunkTrust

Sorry my bad, just add max_match=0 to the regex and it will match everything:

 tag=authentication eventtype="aruba-user-authenticated" | rex max_match=0 "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"
0 Karma

MuS
SplunkTrust
SplunkTrust

this will work as run everywhere search:

| gentimes start=-1 | eval foo="
username=john.doe
username=domain\john.doe
username=other_domain\foo.baz" | rex max_match=0 field=foo "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"  | table user
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...