Splunk Search

eval or rex help

Explorer

Message="Internal event: Function ldap_search entered.
SID: S-1-5-18
Source IP: 127.0.0.1:25855
Operation identifier: 680571
Data1:
Data2: 2796807187
Data3:
Data4:"

How can I just left message "Message="Internal event: Function ldap_search entered."

by rex to define as fields or use eval command?

Labels (1)
Tags (1)
0 Karma
1 Solution

Legend

Hi @keyu921,
probably the message field sould be already automatically extracted by Splunk because there's the pair key=value, if you cannot see it, use the Verbose Mode in search.

If not you can use a regex like this in the rex command or in a guided extraction:

(?ms)Message\=\"(?<Message>.+)\s+SID

that you can test at https://regex101.com/r/5X9OXT/1

Ciao.
Giuseppe

View solution in original post

0 Karma

Legend

Hi @keyu921,
probably the message field sould be already automatically extracted by Splunk because there's the pair key=value, if you cannot see it, use the Verbose Mode in search.

If not you can use a regex like this in the rex command or in a guided extraction:

(?ms)Message\=\"(?<Message>.+)\s+SID

that you can test at https://regex101.com/r/5X9OXT/1

Ciao.
Giuseppe

View solution in original post

0 Karma

Explorer

|rex Message=(?ms)Message=\"(?.+)\s+SID
But seems failed

0 Karma

Legend

Hi @keyu921,
Try:

| rex "(?ms)Message\=\"(?<Message>.+)\s+SID"

P.S.: when you insert a code (like the regex) in a Question or in a Comment, use always the Code sample button (the one with 101010) otherwise your comment isn't readable.

Ciao.
Giuseppe

0 Karma

Explorer

same result

0 Karma

Explorer

it is ok now

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!