Splunk Search

matching issue with a regex in search

rbw78
Communicator

Hello,

I'm having an issue with a regex i did.
I want to create a new column with my regex where there's 2 values possible "corp-sur-tmo03" or "corp-tok-tmo03".

Regex :

"corp-*-ips0*" | rex "(?i)^(?:[^\.]*\.){9}\d+\t\d+\t\d+\t\d+\t\d+\t(?P<NIDS>[^\t]+)" | timechart count by NIDS

90% of the values in the column match well but i got 10% matching nothng and is called "NULL" despite of "corp-sur-tmo03" or "corp-tok-tmo03". Strangely, the word "corp-sur-tmo03" and "corp-tok-tmo03" are highlight in the 10% but not reconignize correctly.

Here some screenshot to understand :

alt text
alt text
alt text
alt text

The event in NULL aren't in "corp-sur-tmo03" or "corp-tok-tmo03" ?

thanks

Rémi

Tags (3)
0 Karma
1 Solution

bwooden
Splunk Employee
Splunk Employee

There may be a slight variation in what is in the event and what is being described in the regex. You can validate that by eliminating the 'prefix' and just look for a match on the interesting text:

"corp--ips0" | rex field=_raw "(?corp-(tok|tok)-tmo03)" | timechart count by NIDS

View solution in original post

0 Karma

bwooden
Splunk Employee
Splunk Employee

There may be a slight variation in what is in the event and what is being described in the regex. You can validate that by eliminating the 'prefix' and just look for a match on the interesting text:

"corp--ips0" | rex field=_raw "(?corp-(tok|tok)-tmo03)" | timechart count by NIDS

0 Karma

rbw78
Communicator

Thanks for your help it worked 😉

Rémi

0 Karma

rbw78
Communicator

Well it seems i also have an issue with screenshots 😉

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...