## Log Parsing & Normalization: The Regex Dojo

You cannot be a Senior Analyst without knowing Regex (Regular Expressions). When standard parsers fail, you must write your own.

### The Problem: Unstructured Data
A developer writes a custom app that logs errors like this:
`[ERROR] User:bob | IP:10.0.0.1 | Msg:Login Failed`

Your SIEM doesn't know what "User:bob" means. You need to extract "bob" into the `user` field.

### Regex Basics
*   `d`: Any digit (0-9).
*   `w`: Any word character (a-z, 0-9, _).
*   `s`: Whitespace.
*   `+`: One or more.
*   `*`: Zero or more.
*   `?`: Optional.
*   `( )`: Capture group (The part you want to extract).

### Example Extraction
Log: `[ERROR] User:bob | IP:10.0.0.1`

**Bad Regex**: `User:.* |`
*   Why? `.*` is greedy. It matches everything until the end. Precise matching is efficient.

**Good Regex**: `User:(w+)s|sIP:(d{1,3}.d{1,3}.d{1,3}.d{1,3})`
*   Group 1 (`w+`) matches "bob".
*   Group 2 matches the IP.

### Splunk Field Extraction (props.conf / transforms.conf)
In Splunk, you define these in config files.
*   `[my_custom_app]`
*   `EXTRACT-user = User:(w+)`

### Field Aliasing (CIM Compliance)
*   Your app logs it as `client_ip`.
*   Splunk CIM expects `src`.
*   **Alias**: `FIELDALIAS-c_ip = client_ip AS src`
*   Now, a search for `src=10.0.0.1` will find your logs automatically.