Message="Internal event: Function ldap_search entered.
SID: S-1-5-18
Source IP: 127.0.0.1:25855
Operation identifier: 680571
Data1:
Data2: 2796807187
Data3:
Data4:"
How can I just left message "Message="Internal event: Function ldap_search entered."
by rex to define as fields or use eval command?
Hi @keyu921,
probably the message field sould be already automatically extracted by Splunk because there's the pair key=value, if you cannot see it, use the Verbose Mode in search.
If not you can use a regex like this in the rex command or in a guided extraction:
(?ms)Message\=\"(?<Message>.+)\s+SID
that you can test at https://regex101.com/r/5X9OXT/1
Ciao.
Giuseppe
Hi @keyu921,
probably the message field sould be already automatically extracted by Splunk because there's the pair key=value, if you cannot see it, use the Verbose Mode in search.
If not you can use a regex like this in the rex command or in a guided extraction:
(?ms)Message\=\"(?<Message>.+)\s+SID
that you can test at https://regex101.com/r/5X9OXT/1
Ciao.
Giuseppe
|rex Message=(?ms)Message=\"(?.+)\s+SID
But seems failed
Hi @keyu921,
Try:
| rex "(?ms)Message\=\"(?<Message>.+)\s+SID"
P.S.: when you insert a code (like the regex) in a Question or in a Comment, use always the Code sample button (the one with 101010) otherwise your comment isn't readable.
Ciao.
Giuseppe
same result
it is ok now