Thanks for the replies.
Just to explain what I am trying...
I am in the Search window and then click next to one of the entries and select "Extract Fields". I have then highlighted the bit I want to extract and dragged it into the Example Values box. Finally, I have then gone through deleting the sample extractions that were wrong.
A pattern never correctly generates as the figures are so small, this is why I thought RegEx would be the correct way to look at the issue.
Twinspop - could you let me know where I should be using the regex as assumed it would have been when extracting but that just failed 🙂
... View more
I have just installed Splunk as want to get some reports out of a Barracuda Spam firewall we have installed that sends all data to a syslog server. I have installed Splunk on the same machine as syslog so getting the file imported was easy.
The problem I am having is with trying to extract fields from the data as I can't seem to 'teach' the system the correct regex.
The following is an example line from syslog (anonomiyzed obviously):
Sep 24 15:34:59 192.168.0.1 inbound/pass1: 114-38-48-47.dynamic.hinet.net[188.8.131.52] 1285338898-663591fe0001-1ljPNx 1285338898 1285338899 RECV email@example.com firstname.lastname@example.org 2 62 184.108.40.206
The data can be totally different which is why Splunk seems to have a problem with it, but the data is always in the same order:
Timestamp: Sep 24 15:34:59
It was all going well until I got to the ActionCode!
There is always whitespace between the 'parts' so am sure it is just a matter of getting the regex correct but am struggling.
Would appreciate some help.
... View more