Splunk Search

Using rex to extract text from tenable sc output

geoffmx
Explorer

I am attempting to extract the share names from the "pluginText" field below.

pluginText:  <plugin_output>
Here are the SMB shares available on the remote host when logged in as SomeAccount:

  - share1$
  - Share-2$
  - share 3
  - share number 4
  - share - number - 5
  - and_so_on
</plugin_output>    

and require the out put to show like this...

share1$
Share-2$
share 3
share number 4
share - number - 5
and_so_on

I had some luck with this... | rex ":* - (?<pluginText>[^<]*)</plugin_output>" | makemv delim=" - " pluginText
... with the exception of share names that contained a " - ". For example, " share - number - 5" gets split into three separate names because of the delimiter.

I've also tried this... | rex "^[^\-\n]*\-\s+(?<pluginText>[^<]*)" | makemv delim="\n - " pluginText

But it's not consistent. Sometimes, I get the share names as intended, and sometimes it just shows all the text including whats not required.
I'm not very strong with regular expressions, so I'm requesting help to get it right on splunk.

1 Solution

spayneort
Contributor
<search> | rex field=pluginText max_match=100 "\\n\s+-\s(?<share>[^\\n]*)"

View solution in original post

spayneort
Contributor
<search> | rex field=pluginText max_match=100 "\\n\s+-\s(?<share>[^\\n]*)"

View solution in original post

geoffmx
Explorer

Thank you! This worked perfectly.

0 Karma

wenthold
Communicator

Try with max_match set to a high value.

| rex max_match=500 "(?:\s*-\s*(?<share_name>.*))" | mvexpand share_name

If you have a field name that contains just the plugin output text with the share list (I'm not familiar with Tenable SC logs) use "field={your field name}" with rex, by default it runs the pattern against the entire _raw message.

lakshman239
SplunkTrust
SplunkTrust

May not be the best one, but would this help?

\-\s+(?<myshares>........?.?.?.?.?.?.?.?.?.?.?)

https://regex101.com/r/CbiPte/2

0 Karma

geoffmx
Explorer

Thanks Laxman!

It works on the sample set provided, but doesn't when tested with actual logs.

I've managed to get it working with this...

    | rex ":* - (?<pluginText>[^<]*)</plugin_output>" 
    | makemv delim="\n  - " pluginText 
0 Karma

klischatb
Path Finder

Hello,
i tried this regex to get only the "-" out of your text.
Maybe this will help:

\s\s(?(-))\s

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.