topic Field extraction in Knowledge Management

Field extraction

thiru1 — Mon, 08 Apr 2019 09:32:28 GMT

My actual data is 'ProcessName'>C:\Windows\System32\lsass.exe
Wanting to extract the field from C:\Windows\System32\lsass.exe as a field called Process
kindly assist get me a query that fetchs the result as "C:\Windows\System32\lsass.exe" and ignore ProcessName'> And

Re: Field extraction

Richfez — Mon, 08 Apr 2019 12:34:44 GMT

If the separator between key and value were and = sign, Splunk would already have figured that out. 🙂

For your problem, though,

... | rex field=Process "'ProcessName'>(?<ProcessName>.*)"

After that you'll have a field named "ProcessName" just like you want.

Happy Splunking,
Rich

Re: Field extraction

grittonc — Mon, 08 Apr 2019 12:40:47 GMT

Give this a try:

   ... 
| rex field=mydata "^.*>(?<Process>.*)$"

This will run anywhere:

| makeresults 
| eval mydata="'ProcessName'>C:\Windows\System32\lsass.exe"
| rex field=mydata "^.*>(?<Process>.*)$"

The regular expression will pull out any characters after the ">" and before the end of the string as the Process field.