I have a string of text from a syslog feed source:
Nov 8 16:16:51 192.168.2.10 Nov 8 16:16:19 SuperServer PES0: Site: Sitename,Server:
Srvr1,Domain: Default,Admin: user1,Policy has been fixed,Policyname - X
I am trying to extract the last three fields from this data, and I can't seem to get it to work. I'm only trying it out in Search first, but am thinking of using an EXTRACT in props.conf finally. The rest of the regex I have doublechecked, using a Perl Regex editor and RegExr, too. All of the syntax seems to be correct, until I try to extract the fields. Here's the regex with search command I have so far:
Source=syslog | rex ".*,Admin:\s(?<user>\w+),(?<message>.*),(?<policy>.*)" | table user message policy
But my field extraction attempts here yield nothing so far. Any suggestions?
My follow on issue is that I get additional logs from this same source:
Nov 8 16:16:51 192.168.2.10 Nov 8 16:16:19 SuperServer PES0: MACHINE_NAME,Continue,,File Read,Begin: 2012-10-03 01:54:38,End: 2012-10-03 01:54:38,Rule: Log write - media,3196,C:/Windows/System32/svchost.exe,0,No Module Name,C:/Temp/filename.txt,User: SYSTEM,Domain: STANDALONE,Action Type:
Here is the regex I have so far to extract fields from it, too:
Source=syslog | rex ".*PES0:\s(?<machine>\w+),(?<srvr_action_taken>\w+),,(?<user_action_taken>\w+\s\w+),Begin:\.*Rule:\s(?<rule_used>.*),\d+,(?<process_called>.*),\d+,No\sModule\sName,(?<filename>.*),User:\s(?<user>\w+),Domain:\s(?<domain>\w+)" | table _time machine srvr_action_taken user_action_taken rule_used process_called filename user domain
(The table commands are just so I can view the output quickly.)
Also, any suggestions for how I should use these two regexes in a props.conf EXTRACT entry/stanza? I think that's probably the best way to proceed.
Would it make more sense to use a REPORT and have its transform employ DELIM instead?
IS there a way to use both of these regexes against one source, in an EXTRACT or REPORT or transform?
I imagine this will be an easy question for the Splunk Community, but the answer so far escapes me....Any help would be appreciated, I am just starting to learn Regex now....
... View more