Using Transfroms.conf to drop parts of a file path

defikes — Fri, 19 Mar 2021 12:26:54 GMT

I am new to using the Transfroms.conf and props.conf to manipulate data. The issue we are experiencing is in our WinEventLog data, we have a field that comes over as Creator Process Name

Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe

However most of the correlation searches are looking for process name, parent process name, etc. I have created a field alias to have the Creator Process Name also follow parent process name. I am trying to use Transforms and props in order to drop most of the file path for process name field, for example:

Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe

Process Name: splunkd.exe

Here is my current entry in Transfroms.conf

[Creator_Process_Name_as_process_name]
SOURCE_KEY = Creator_Process_Name
REGEX = \t\w:.*[\\](?<process_name>.*)\n
FORMAT = process_name::$1

and in Props.conf

TRANSFORMS-Creator_Process_Name_as_process_name = Creator_Process_Name_AS_process_name

Doesn't seem to be working like it should, I actually do get a process name populated but it is the whole flie path. Regex101 seems to show the Regex to be correct in just pulling the .exe

Re: Using Transfroms.conf to drop parts of a file path

Vardhan — Fri, 19 Mar 2021 13:20:05 GMT

HI @defikes ,

In order to drop events which are having Process name you can use below props& transfroms.

props.conf

TRANSFORMS-dropevents = process_name

transforms.conf

[process_name]

REGEX = \t\w:.*[\\](.*)\n (test your regex before placing here)

DEST_KEY = queue
FORMAT = nullQueue

topic Using Transfroms.conf to drop parts of a file path in Getting Data In

Using Transfroms.conf to drop parts of a file path

Re: Using Transfroms.conf to drop parts of a file path