I have just installed Splunk as want to get some reports out of a Barracuda Spam firewall we have installed that sends all data to a syslog server. I have installed Splunk on the same machine as syslog so getting the file imported was easy.
The problem I am having is with trying to extract fields from the data as I can't seem to 'teach' the system the correct regex.
The following is an example line from syslog (anonomiyzed obviously):
The data can be totally different which is why Splunk seems to have a problem with it, but the data is always in the same order:
It was all going well until I got to the ActionCode!
There is always whitespace between the 'parts' so am sure it is just a matter of getting the regex correct but am struggling.
Would appreciate some help.
asked 24 Sep '10, 14:46
answered 24 Sep '10, 17:43
Thanks for the replies.
Just to explain what I am trying...
I am in the Search window and then click next to one of the entries and select "Extract Fields". I have then highlighted the bit I want to extract and dragged it into the Example Values box. Finally, I have then gone through deleting the sample extractions that were wrong.
A pattern never correctly generates as the figures are so small, this is why I thought RegEx would be the correct way to look at the issue.
Twinspop - could you let me know where I should be using the regex as assumed it would have been when extracting but that just failed :)
answered 28 Sep '10, 16:07