×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
mauriziotarducc
Loves-to-Learn
Member since: ‎03-06-2023
‎03-27-2023
Community Statistics
Posts 6
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎03-06-2023
Activity Feed
Topics I've Started
View All

Re: How to build fields?

by in Other Usage
‎03-27-2023 01:51 AM
‎03-27-2023 01:51 AM
Hello i did the following and now is ok  "Compliance Failure" | rex "Compliance Failure='(?<DESCRIPTION>[^']*)'\s*\[(?<DISANUM>[^\]]+)\]" Regards Maurizio ... View more

Re: How to build fields?

by in Other Usage
‎03-27-2023 12:43 AM
‎03-27-2023 12:43 AM
Hello good morning  executing your new rex what i have is :   1 23/03/23 13:23:52,425 { [-]    Cat: Policy Manager    HostName: SND1    Record: Mar 23 09:23:52 SND1 baspm[33620189]: Compliance Failure='Port=23 included in configuration for TN3270 is not as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments' [DS223821]    SAF: 1    SAFD: RACF    Severity: Info    Time: 2023-03-23T13:23:52.425 }   But not Description and DISANUM .  Maurizio ... View more

Re: How to build field

by in Other Usage
‎03-24-2023 08:51 AM
‎03-24-2023 08:51 AM
or better based on the last example : DESCRIPTION = 'PASSWORD(INTERVAL) for UserId=ZSX110 should be 60 days. It is currently set to 120' thanks  Maurizio ... View more

Re: How to build field

by in Other Usage
‎03-24-2023 08:50 AM
‎03-24-2023 08:50 AM
Hello thanks  ok partially worked because  for the filed DESCRIPTION i just have Compliance Failure i shout have : DESCRIPTION = 'Port=23 included in configuration for TN3270 is not as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments' can yu help me ?  Maurizio ... View more

Re: How to build field

by in Other Usage
‎03-23-2023 06:47 AM
‎03-23-2023 06:47 AM
Thanks  i have another request : i have the a text like (JSON Format)  :  {"Time": "2023-03-23T13:23:50.551", "HostName": "SND1", "Cat": "Policy Manager", "Severity": "Info", "SAF": 1, "SAFD": "RACF", "Record": "Mar 23 09:23:49 SND1 baspm[33620189]: Compliance Failure='PASSWORD(INTERVAL) for UserId=ZSX110 should be 60 days. It is currently set to 120' [DS223718]"}  i would like to have DESCRIPTION fileld based on "Complaince Failure" and DISANUM based on the content of [ and ]  character at the end of the string (in the above example the DISANUM is [DS223718] . Thanks in advance  Maurizio  ... View more

How to build fields?

by in Other Usage
‎03-06-2023 02:14 PM
‎03-06-2023 02:14 PM
Hello  Having log like :  <182>Mar 1 18:18:24 SND1 Policy Manager severity=Info saf=1 safd=RACF record=Mar 1 13:17:31 SND1 baspm[67174579]: Compliance Failure='Sensitive Dataset=USS.SND2.VAR resides on z/OS shared DASD volume=SN2U01 but is not part of SPM dataset filter=SHRD' [DS33795] i would extract the fields : SND1 as LPAR  field [DS33795] ad DISANUM field 'Sensitive Dataset=USS.SND2.VAR resides on z/OS shared DASD volume=SN2U01 but is not part of SPM dataset filter=SHRD' as DESCRIPTION field  Can you help me writing the regex ? i started to write the following "Compliance Failure" sourcetype="AMI SPM" | rex field=_raw "^(?:[^:\n]*:){2}\d+(?P<LPAR>\s+\w+)(?:[^\[\n]*\[){2}(?P<DISANUM>\w+)" offset_field=_extracted_fields_bounds | stats count by DISANUM but i m not able to get the string after Compliance Failure  into the field DDESCRIPTION Thanks in advance  Maurizio ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎03-27-2023 04:08 AM