About mydog8it

mydog8it · ‎05-31-2019

I noticed the quotes in your regex are two different characters, the first pair do not match the text. Here is a suggestion that closely matches your regex: without a named field---> |rex field=_raw "\"(.+[^>])\"$" with a named field ---> |rex field=_raw "\"(?<FieldName>.+[^>])\"$"

mydog8it · ‎05-30-2019

That checks for all the fields to the end of the message, its ugly but got rid of false matches.

mydog8it · ‎05-30-2019

\b(?<http_status>\d{3})\s\d+\s\d+\s\d+\s\d+\.\d+\.\d+\.\d+

mydog8it · ‎05-30-2019

https://rubular.com/r/cNK8laTGhhCYAG

mydog8it · ‎05-30-2019

How are you trying to use the regex? Are you trying to use it in SPL or as part of a conf? Can you better define what you are trying to collect? The question describes trying to collect the "fromIndex=" value but the regex looks like it is trying to extract the http status value. My suggestion was for the http status code.

mydog8it · ‎05-30-2019

I think this is what you want.... \*\*(?<http_status>\d{3})\*\*

mydog8it · ‎05-22-2019

You pretty much have the answer in your transforms. "Your search"|REGEX _raw=((?[^|&#; ]\/)?(?[^|&#; ]+)( *(?[^&|#;](-exec)|[^&|#;]*))?)

mydog8it · ‎03-28-2019

Can you provide example data and an example of how you would like it parsed? It sounds to me like you could just use two capture groups with the names "startOfPath" and another named "restOfPath".

mydog8it · ‎03-25-2019

If you don't use a field name the search command will interpret the CIDR as a string, it will not make a match. You must use a field name in the search, like src_ip or dest_ip.

mydog8it · ‎03-20-2019

Try putting the statements on either side of the "or" in parenthesis. sourcetype=mysourcetype | rex field=_raw max_match=0 "(?<_KEY_1>((?:[A-Z]\w+\s){0,1}+[A-Z]\w+):^\S\t\n\r\s)"

mydog8it · ‎03-05-2019

Search in a stats count by type search and then only redirect the interesting fields to a table, the results will only be the fields you send to the table. Does that help?

mydog8it · ‎02-27-2019

In props.conf on Heavy Forwarder add the following: [source::/var/log/messages] TRANSFORMS-set= setnull,setparsing In the transforms.conf add the following: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = log\.UatErrorLogger\s\-\s\|ERROR\| DEST_KEY = queue FORMAT = indexQueue

mydog8it · ‎02-25-2019

When you set up the Authentication Method it is either LDAP OR SAML in the UI, not both. Perhaps there is a way in the conf files. My experience is in SAML configuration. Local Auth can be enabled at the same time. To use local you must enter a different URL so as to not engage the SAML redirect. something like this... https://xxxxxx.splunkcloud.com/en-US/account/login?loginType=splunk

mydog8it · ‎02-13-2019

I don't see your regex working in regex101 with the sample provided. This regex matches your sample in regex101... UserName\(?P [^"]*) so perhaps this would work in Splunk... rex field=_raw "UserName\(?P [^"]*)"

mydog8it · ‎02-12-2019

Your Search History is presented in the app you used to launch the Search. I have a default app that is created for my users and search is available to them in that app. The Search History that accumulates in that app does not propagate to other apps. So if the user navigates outside of their default app and lunches search from that location their history is not available to them that was "learned" in the default app. Hope this helps...

mydog8it · ‎02-12-2019

Tanium only provides output to syslog and SplunkCloud does not have a syslog collector available in the cloud. So, the solution I deployed was to collect the data on-premise in a syslog server with a UF installed. Create an config for the UF to watch the file system the syslog server writes to and the data will be forwarded out the same way that any of your on-prem data flows to SplunkCloud. No additional firewall rules unless you need one to get from the Tanium server to the syslog server.

mydog8it · ‎02-08-2019

Without trying to modify your regex, does this help? |rex field=_raw "((Target\sAccount\:\s+Security\sID\:\s*)COMPANY\\(?<ABC>[^ ]+)Account)"

mydog8it · ‎02-08-2019

My goodness I struggle with this UI sometimes!

mydog8it · ‎02-08-2019

^msg:\s\d+:(?P<modelname>[a-zA-Z\s\d\_]+\s(?=\d+\.\d+)(?P<time>\d+\.\d+))

mydog8it · ‎02-08-2019

^msg:\s\d+:(?P<modelname>[a-zA-Z\s\d\_]+\s(?=\d+\.\d+)(?P<time>\d+\.\d+))

mydog8it · ‎02-08-2019

I get what you want now, how is this... ^msg:\s\d+:(?P[a-zA-Z\s\d_]+\s(?=\d+.\d+)(?P\d+.\d+))

mydog8it · ‎02-08-2019

I think this is what you are asking for.... ^msg:\s30947:(?P[a-zA-Z\s]+(?P\d+.\d+))

mydog8it · ‎02-08-2019

I think you are going to need to provide more detail. I don't think many of us know what "Task 1 Step 3 of Lab Module 5" is.

mydog8it · ‎02-07-2019

The answer to the question in the title is just pipe it to the name of the macro with "tics" around the macro name (| notable_owners ).

mydog8it · ‎02-07-2019

I do not have Checkpoint experience, but here is info from Checkpoint's website: Logs shows that traffic is dropped with "message_info: Address spoofing" in the "Information" field. These logs appear for inbound packets on the external interface of Security Gateway, although these packets were received from the network that belongs to the same external interface. Search for the action in the messages that match above

Posts	144
Solutions	11
Karma Given	30
Karma Received	26
Member Since	‎10-01-2015

Online Status	Offline
Date Last Visited	‎09-13-2022 12:15 PM

Determining the max value of a multivalue field co...

Help with stats: identify the latest result for ea...

Help with Splunk 6.3 Simple XML text input box: co...

Re: regex for extracting word after symbol

Re: regex help with existing regex

Re: regex help with existing regex

Re: regex help with existing regex

Re: regex help with existing regex

Re: regex help with existing regex

Re: How to use field transformations in a splunk s...

Re: Is it possible to append/concatenate regexes f...

Re: search cidr without using "src_ip OR dest_ip"?

Re: Regex field extraction

Re: Remove fields from a query

Re: How do you create a regex that keeps only spec...

Re: Is it possible to use SAML, LDAP and Splunk au...

Re: How do you use regex to escape a backslash?

Re: What reasons could cause a user to lose their ...

Re: How to Integrate Tanium with Splunk Cloud..?

Re: Help with regex

Re: Regex help

Re: Regex help

Re: Regex help

Re: Regex help

Re: Regex help

Re: Splunk Fundamentals 1 - Lab Module 5 Question

Re: How do I add macros into my search?

Re: Using Splunk to analyze firewalls, how can I d...