I have a field extraction which extracts the User Name. Some users will authenticate with their user name, but some will also pre-fix it by the domain.
How can I strip out the domain in the field extraction if the user includes the domain to authenticate?
I referred to this https://answers.splunk.com/answers/172242/how-to-use-rex-to-remove-the-domain-from-the-user.html , but the extraction will only extract those user names pre-fixed by domain.
You can modify your field extraction logic pull out both the user and domain, and allow the domain to be skipped if not present.
The sample below will extract three fields. username will contain the full results, user_domain will contain "domain" in second example above, and will be blank for the first. user will contain john.doe for both examples you gave.
Put the following into your transforms.conf:
[user-with-domain] REGEX = username=((?:([^\\]+)\\)?(\S+)) FORMAT = username:$1 user_domain::$2 user::$3
And activate it via props.conf:
[mysourcetype] REPORT-user = user-with-domain
I have tried this workaround but it seems that it doesn't work all the time.
I have 4 sourcetypes (for Sophos Endpoint logs) and I have created this configuration for all of them at the same files (local folder of Splunk_TA_sophos app).
It seems that it works for the three of them and not for the forth. Any ideas why this is happens?
try this crazy
your base search here | rex "(?:=(?!\w+\\)|(?<!=)\\)(?<user>\S+)" | ...
This will search for a
= not followed by a word character and a
\ or a
\ not leaded by a
= and takes in any non whitespace character as field
user - tested and working on http://regex101.com and you will get a better explanation there as well 🙂
Hope this helps ...
Thanks for the comment.
tag=authentication eventtype="aruba-user-authenticated" | rex "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"
But it matches
Sorry my bad, just add
max_match=0 to the regex and it will match everything:
tag=authentication eventtype="aruba-user-authenticated" | rex max_match=0 "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"
this will work as run everywhere search:
| gentimes start=-1 | eval foo=" username=john.doe username=domain\john.doe username=other_domain\foo.baz" | rex max_match=0 field=foo "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)" | table user