Splunk Search

v4.1.4 REGEX works.....v4.3.2 Doesn't

MasterOogway
Communicator

I have a hostname extraction TRANSFORMS.conf that works in v4.1.4, but since our upgrade to v4.3.2 it now doesn't extract the hostname. I have tried numerous changes to the REGEX on the new install but to no avail.

Example of incoming data:

<14>Jul 13 13:55:31 Message forwarded from hostname123:

Transforms.conf that worked:

[syslog-host-aix]

DEST_KEY = MetaData:Host

REGEX = \w+\s+\d+\s+\d{2}:\d{2}:\d\d\s+Message\sforwarded\sfrom\s([^:]+)

FORMAT = host::$1

I have tried many variations of the REGEX below in the Transforms.conf but none work.

[syslog-host-aix]

DEST_KEY = MetaData:Host

REGEX = .?Message\sforwarded\sfrom\s(\w):.* < ---- tried capturing entire line to no avail

REGEX = \w+\s+\d+\s+\d{2}:\d{2}:\d\d\s+Message\sforwarded\sfrom\s(.*?):

FORMAT = host::$1

Did something change in REGEX's from the older versions to the newer versions of Splunk? Any ideas of REGEX's to try ? I am on version 10 and counting.

Tags (2)
0 Karma

hurricanelabs
Path Finder

This is working for me with without the log facility and level.

\w+\s\d+\s\d{1,2}:\d{1,2}:\d{1,2}\sMessage\sforwarded\sfrom\s([^:]+)

If you need to include it you could do:

\<\d{2}\>\w+\s\d+\s\d{1,2}:\d{1,2}:\d{1,2}\sMessage\sforwarded\sfrom\s([^:]+)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...