RegEx in Splunk Search

0
votes

I'm new to Splunk, as you'll see, but I have inherited trying to figure out an existing dashboard and to modify it.

Existing Search:

"Policy_Name=Authentication EventCode=1   *$name$*  
| eval TimeOfRequest= _time | table TimeOfRequest, ResultMessage, 
|rex field=_raw (FullyQualifiedUserName=[^/]+$), Calling_Station_Identifier 
| convert timeformat="%b %d, %Y %I:%M:%S %p" ctime(TimeOfRequest)"

Output:

TimeOfRequest Dec 10, 2015 11:04:16 AM
ResultMessage User BobSmith was granted access.
FullyQualifiedUserName domain.local/OU1/OU2/OU3/OU4/Smith, Bob
Calling_Station_Identifier 192.168.1.1

I've been asked for a slight modification to the output. I need to cleanup the FullyQualifiedUsername by removing the full path with only leaving Lastname, Firstname, i.e. "Smith, Bob". I looked into running some sort of regex against the field, but I'm not yielding any results, just errors.

Example of my queries below:

"Policy_Name=Authentication EventCode=1   *$name$* 
| eval TimeOfRequest= _time 
| table TimeOfRequest, ResultMessage, regex 
       (FullyQualifiedUserName = [^/]+$), Calling_Station_Identifier
| convert timeformat="%b %d, %Y %I:%M:%S %p" ctime(TimeOfRequest)"

or

Policy_Name=Authentication EventCode=1   *$name$*  
| eval TimeOfRequest= _time | table TimeOfRequest, ResultMessage, 
| rex field=FullyQualifiedUserName "[^/]+$", Calling_Station_Identifier
| convert timeformat="%b %d, %Y %I:%M:%S %p" ctime(TimeOfRequest)

Any help trying to figure this query would be much appreciated.

1
regexsplunk

1 Answers

1
votes

I have no Splunk instance close to me but maybe this will help you:

... | rex field=FullyQualifiedUserName ".+\/(?<first>.+),\s?(?<second>.+)"

If you want to know more about the regexp test:

.+\/(.+),\s?(.+)

on https://regex101.com/

You should be able to do this after:

... | top first second

I assume all your logs have the same format of course.

Source: http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Rex

Tell me if you have error...