Splunk Search

Help with SPL and REX for 2 separate ID's in 1 event

LizAndy123
Path Finder

I have an Event where I can extract the 2 different ID's but how do I show that id 1 gave access to id 2?

Sample event 

User-ABCDEFG assigned Role-'NewRole' on Project-1234 to ABCDEFG

I need to say the User-ABCDEFG gave access to ABCDEFG in a stats sort of way - the user may give 4 or 5 accesses a day so I would then create a report which shows that that user did.

Labels (1)
Tags (1)
0 Karma
1 Solution

rafamss
Contributor

Hi @LizAndy123,

Following the @gcusello understanding, I added a few more context to the results.

| rex field=_raw "User-(?<User>\w+)\s+assigned\s+Role-(?<Operation_Type>.+?)\s(?<Where>.+?)\sto\s(?<ToUser>.+?)$"

 In these case, I'm supposing that you can tell to the stakeholders the following:

User= The person who execute the operation

Operation_Type= What operation was did

Where= The asset that was changed in this operation

ToUSer= The user whom received the permission

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @LizAndy123 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

rafamss
Contributor

Hi @LizAndy123,

Following the @gcusello understanding, I added a few more context to the results.

| rex field=_raw "User-(?<User>\w+)\s+assigned\s+Role-(?<Operation_Type>.+?)\s(?<Where>.+?)\sto\s(?<ToUser>.+?)$"

 In these case, I'm supposing that you can tell to the stakeholders the following:

User= The person who execute the operation

Operation_Type= What operation was did

Where= The asset that was changed in this operation

ToUSer= The user whom received the permission

 

gcusello
SplunkTrust
SplunkTrust

Hi @LizAndy123 ,

et me understand:

you want to extract the user fields (that's located at the beginning of the event) and the resource to access (that's located at the end of the event).

In  this case you have to use two regexes:

| rex "^(?<user>[^ ]+)"
| rex "(?<resource>\w+)$"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...