Splunk Search

REGEX help .. I am still learning ....

Stephen11
Explorer

To all:

Still learning about REGEX ...  I looked at RUBULAR.COM and REFEX101.com to figure out how to pull out the Users ids...   In the example below need to get 4 User Ids out ...   I matched on single quote ' - however not able to get  the 4 ids in one swoop ... any suggestions?  Its just not that easy... 

Watched a couple of Youtubes on regex ... just not that all intuitive when condition are a little bit more tricky. appreciate any help I can get.

 

Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

With your example this seems to work.

index=_internal
| head 1
| eval _raw = "Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx"
| rename COMMENT AS "previous set example data, next do the regex"
| rex max_match=0  "Last usernames used in login requests are:\s(?<NamesAll>[^\.]+)"
| rex max_match=0 field=NamesAll "([',\s\.])+(?<Names>[^']+)"

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

With your example this seems to work.

index=_internal
| head 1
| eval _raw = "Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx"
| rename COMMENT AS "previous set example data, next do the regex"
| rex max_match=0  "Last usernames used in login requests are:\s(?<NamesAll>[^\.]+)"
| rex max_match=0 field=NamesAll "([',\s\.])+(?<Names>[^']+)"

r. Ismo 

thambisetty
SplunkTrust
SplunkTrust

Can you share sample event?

the example you shared is not clear.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...