Splunk Search

Help with SPL and REX for 2 separate ID's in 1 event

LizAndy123
Path Finder

I have an Event where I can extract the 2 different ID's but how do I show that id 1 gave access to id 2?

Sample event 

User-ABCDEFG assigned Role-'NewRole' on Project-1234 to ABCDEFG

I need to say the User-ABCDEFG gave access to ABCDEFG in a stats sort of way - the user may give 4 or 5 accesses a day so I would then create a report which shows that that user did.

Labels (1)
Tags (1)
0 Karma
1 Solution

rafamss
Contributor

Hi @LizAndy123,

Following the @gcusello understanding, I added a few more context to the results.

| rex field=_raw "User-(?<User>\w+)\s+assigned\s+Role-(?<Operation_Type>.+?)\s(?<Where>.+?)\sto\s(?<ToUser>.+?)$"

 In these case, I'm supposing that you can tell to the stakeholders the following:

User= The person who execute the operation

Operation_Type= What operation was did

Where= The asset that was changed in this operation

ToUSer= The user whom received the permission

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @LizAndy123 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

rafamss
Contributor

Hi @LizAndy123,

Following the @gcusello understanding, I added a few more context to the results.

| rex field=_raw "User-(?<User>\w+)\s+assigned\s+Role-(?<Operation_Type>.+?)\s(?<Where>.+?)\sto\s(?<ToUser>.+?)$"

 In these case, I'm supposing that you can tell to the stakeholders the following:

User= The person who execute the operation

Operation_Type= What operation was did

Where= The asset that was changed in this operation

ToUSer= The user whom received the permission

 

gcusello
SplunkTrust
SplunkTrust

Hi @LizAndy123 ,

et me understand:

you want to extract the user fields (that's located at the beginning of the event) and the resource to access (that's located at the end of the event).

In  this case you have to use two regexes:

| rex "^(?<user>[^ ]+)"
| rex "(?<resource>\w+)$"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...