Splunk Search

eval or rex help

keyu921
Explorer

Message="Internal event: Function ldap_search entered.
SID: S-1-5-18
Source IP: 127.0.0.1:25855
Operation identifier: 680571
Data1:
Data2: 2796807187
Data3:
Data4:"

How can I just left message "Message="Internal event: Function ldap_search entered."

by rex to define as fields or use eval command?

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @keyu921,
probably the message field sould be already automatically extracted by Splunk because there's the pair key=value, if you cannot see it, use the Verbose Mode in search.

If not you can use a regex like this in the rex command or in a guided extraction:

(?ms)Message\=\"(?<Message>.+)\s+SID

that you can test at https://regex101.com/r/5X9OXT/1

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi @keyu921,
probably the message field sould be already automatically extracted by Splunk because there's the pair key=value, if you cannot see it, use the Verbose Mode in search.

If not you can use a regex like this in the rex command or in a guided extraction:

(?ms)Message\=\"(?<Message>.+)\s+SID

that you can test at https://regex101.com/r/5X9OXT/1

Ciao.
Giuseppe

0 Karma

keyu921
Explorer

|rex Message=(?ms)Message=\"(?.+)\s+SID
But seems failed

0 Karma

gcusello
Legend

Hi @keyu921,
Try:

| rex "(?ms)Message\=\"(?<Message>.+)\s+SID"

P.S.: when you insert a code (like the regex) in a Question or in a Comment, use always the Code sample button (the one with 101010) otherwise your comment isn't readable.

Ciao.
Giuseppe

0 Karma

keyu921
Explorer

same result

0 Karma

keyu921
Explorer

it is ok now

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...