Splunk Search

Rex question

garciajbg
Explorer

Hello everyone, I am trying to extract several “NEW” fields from a field and I am having trouble doing so.

The field I am trying to extract from is a default field in an index but for some reason, the field name and its contents are not located in the "_raw" field. So, I am unable to use the built-in Splunk extractor to accomplish what I am trying to do.
The contents of the sourcefield varies as seen below.

  1. sourcefield=/var/log/bash_history/localuser/DOMAIN\first.last.domain
    • I need to extract "localuser" as field1, "DOMAIN" as field 2, and "first.last.domain" as field3.

  2. sourcefield=/var/log/bash_history/DOMAIN\first.last.domain/DOMAIN\first.last.domain
    • I need to extract “DOMAIN” as field2 and “first.last.domain” as field3

Would it make sense to use the first example to extract all fields since both content paths share similar strings with the exception of “localuser”? That way, if the “localuser” field doesn’t exist it would just see it as NULL value?
Any help will be greatly appreciated.

Labels (2)
0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults 
| eval sourcefield="/var/log/bash_history/localuser/DOMAIN\first.last.domain" 
| appendpipe 
    [ eval sourcefield="/var/log/bash_history/DOMAIN\first.last.domain/DOMAIN\first.last.domain"] 
| rename COMMENT as "from here, the logic"
| eval tmp1=mvindex(split(sourcefield,"/"),4), tmp2=mvindex(split(sourcefield,"/"),5) 
| eval field1=if(tmp1!=tmp2,tmp1,NULL) 
| eval field2=if(tmp1==tmp2,mvindex(split(tmp1,"\\"),0),NULL)
| eval field3=if(tmp1==tmp2,mvindex(split(tmp1,"\\"),1),NULL)

I think REGEX does not need.

0 Karma

garciajbg
Explorer

@gcusello I am not sure what you are asking. Is the question, how many results can the "field1" potentially have? If so, filed1 should not have more than 4 results (i.e. name1, name2, name3, or name4).

I had something similar to what you posted and I was never able to get the DOMAIN to field to extract. I will try what you posted and I will post my results shortly.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @garciajbg,
the problem is field, because field 2 and 3 are easy to extract, so: there's a rule to identify field1 (e.g. w limited set of values)?

Anyway, to extract the other fields, try this regex:

(?<field2>\w+)\\(?<field3>[^\/]+)$

that you can check at https://regex101.com/r/DaqLjq/1 .

Ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

if the values in field1 are few (four as you said), you could use two regexes:

the one above to extarct field2 and field3

the following to extract field1

\/\w+\/\w+\/\w+\/(?<field1>localuser|user2|user3|user4)/

Ciao.
Giuseppe

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!