IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Regex Data Format

    Posted Fri January 31, 2020 01:27 AM
    Hello community,


    An actual raw log example is:
    <142>Jan 30 15:27:47 mx2 bmserver: 1580383667|50538744-5afff7000000136c-c7-5e32bdb3d3ce|VERDICT|<none>|connection_class_1|default|static connection class 1

    I need correct Date Format to parse Log Source Time

    thank you


    ------------------------------
    Davit Ubilava
    System Administrator
    Delta Consulting LLC
    Tbilisi,Georgia
    ------------------------------


  • 2.  RE: Regex Data Format

    Posted Mon February 03, 2020 02:31 AM
    Hi,

    I am facing the same issue. Wating for the replies.

    ------------------------------
    Halil BALIM
    ------------------------------

    Original Message


  • 3.  RE: Regex Data Format

    Posted Tue February 04, 2020 03:08 AM
    I think Jonathan addressed something like this in the forums :
    https://developer.ibm.com/answers/questions/385125/format-for-overriding-log-source-time-in-dsm-edito/

    ------------------------------
    Dusan VIDOVIC
    ------------------------------

    Original Message


  • 4.  RE: Regex Data Format

    Posted Fri February 07, 2020 10:08 AM
    Hi,

    I think you must use $1 with format string.


    ------------------------------
    Ali Rıza Yüksektepe
    ------------------------------

    Original Message


  • 5.  RE: Regex Data Format

    Posted Mon March 30, 2020 09:03 AM
    Hi Davit,

    The date format string hat a hyphen ("-") between "MMM" and "dd" whereas the actual log message does not. Could that be the reason for the regex matching the timestamp but the log source time not being parsed?

    Cheers,

       Andreas

    ------------------------------
    Andreas Leibl
    ------------------------------

    Original Message


  • 6.  RE: Regex Data Format

    Posted Tue March 31, 2020 01:32 PM
    Ali and Andreas each have half the answer. The Format String field uses $x notation to refer to capture groups in the Regex field, so you need to use $1, not 1 as your Format String. Just using "1" would set the value to a literal "1".

    The Date Format also needs to be adjusted, it should be:

    MMM dd HH:mm:ss

    no dash/hyphen between "MMM" and "dd".

    Cheers
    Colin

    ------------------------------
    COLIN HAY
    ------------------------------

    Original Message


Related Content