Splunk Search

field value is being extracted as fieldname in regex

michaelrosello
Path Finder

I am trying to extract xml fields using regex but I am encourtering this issue for this specific tags, It is working with other tags. I have tested my regex in regex101 and it is working properly. https://regex101.com/r/ivJjTE/1

In this example below, CrawlTraffic is being extracted properly, but CrawlTraffic value is also being extracted as a new field with "" as a value.

alt text

props.conf

[nexpose_appspider]
TRANSFORMS-null= setnull
BREAK_ONLY_BEFORE = <Vuln>
NO_BINARY_CHECK = true
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = <ScanDate>
MAX_TIMESTAMP_LOOKAHEAD = 19
TRUNCATE = 0
disabled = false
pulldown_type = true
REPORT-xmlext11 = xml-extr11

transforms.conf

[xml-extr11]
REGEX = <([^>]+)>([^<]*)<\/\1>
FORMAT = $1::$2
MV_ADD = true
REPEAT_MATCH = true

[setnull]
REGEX = <VulnSummary>
DEST_KEY = queue
FORMAT = nullQueue
0 Karma
1 Solution

thomasroulet
Path Finder

Hello,

you should add KV_MODE=none in props.conf for nexpose_appspider sourcetype.
By default KV_MODE is set to auto.
It will ensure that splunk will not try to extract key=value pattern.
In your exemple the value of CrawlTraffic finishes by "=".
Splunk extracts the pattern. That's why the value is empty.

View solution in original post

thomasroulet
Path Finder

Hello,

you should add KV_MODE=none in props.conf for nexpose_appspider sourcetype.
By default KV_MODE is set to auto.
It will ensure that splunk will not try to extract key=value pattern.
In your exemple the value of CrawlTraffic finishes by "=".
Splunk extracts the pattern. That's why the value is empty.

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...