topic Re: Regex file name after space in Splunk Dev

Regex file name after space

jacqu3sy — Tue, 29 Sep 2020 18:43:57 GMT

Hi,

Regex wimp here...

I need to extract the file name after the word detected fro ma _raw event.

Example of _raw log;

change to a file has been detected /etc/fileinquestion.conf

I've tried the following but it errors;

| rex field=_raw "detected\s*(?*)"

Any helps appreciated. Thanks.

p_gurav — Thu, 29 Mar 2018 09:58:23 GMT

Hi can you try:

    | rex field=_raw "detected\s*(?P<filename>.*)"

tiagofbmm — Thu, 29 Mar 2018 10:08:08 GMT

Considering that your message might vary the part before the file name, i think you should use a negative lookahead style, like this

 | rex field=_raw "(?=\/)(?P<filename>.*)"

jacqu3sy — Thu, 29 Mar 2018 10:31:29 GMT

It works, but I'm not sure how!? Would you mind explaining what the (?=\/) achieves?

jacqu3sy — Thu, 29 Mar 2018 10:31:41 GMT

Worked a treat. Thanks.

tiagofbmm — Thu, 29 Mar 2018 10:39:14 GMT

It says to the regex processor to not capture anything until it finds the /.

It is more agile than assuming the logs always have the word "detected". But it's up to your specific scenario though.

If it suits you, please upvote the answer as it is a valid option

p_gurav — Thu, 29 Mar 2018 10:39:32 GMT

Please accept answer if its helpful.. 🙂

jacqu3sy — Thu, 29 Mar 2018 11:01:54 GMT

Great. Thanks.