Splunk Search

What rex can I use to extract a value before a string near the end of an event?

octavioserpa
New Member

I need to extract the value where "SoftFail" from this example log is.

In related logs, the value is always after an email address, and before (v=spf1). The value always has one space before it. At first glance, looking for a value after email address seems like it could work, but there are many domain possibilities, including those with subdomains so it's hard to use rex based on @ and x amount of .'s)

Is there away to capture like the following?:

  • start at end of line
  • work backwards to space before (v=spf1), capture the value as SPF_Result field, stop at the first space before the value

Oct 25 21:16:05 x.x.x.x Splunk_PIApp_MailLogs_QDC: Info: MID 92041462 SPF: mailfrom identity foo@bar.com SoftFail (v=spf1)

Tags (2)
0 Karma

wrangler2x
Motivator

This will work:

\S@[^\s]+\s+(?<SPF_RESULT>[^ ]+)

See it in action here: https://regex101.com/r/zzf5RJ/1

0 Karma

inventsekar
SplunkTrust
SplunkTrust
| makeresults | eval log="Oct 25 21:16:05 x.x.x.x Splunk_PIApp_MailLogs_QDC: Info: MID 92041462 SPF: mailfrom identity foo@bar.com SoftFail (v=spf1)" 
| rex field=log "(?P<mailid>\w+\@\w+\.\w+) SoftFail"
| table log mailid

alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

renjith_nair
Legend

@octavioserpa,

Try

|rex field=_raw ".*\s(?<SPF_Result>\w+)\s\(v=spf1\)"

OR

|rex field=_raw "(?<SPF_Result>\w+)\s\(v=spf1\)"

Second one is bit expensive 🙂

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

@octavioserpa, if any of the answers helped you , please accept /upvote or comment here if you need further assistance

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

MuS
Legend

Hi octavioserpa,

please remove all IP's or email address before you post log samples 🙂

cheers, MuS

PS: I removed them from this post 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...