topic Re: Local Processes Tracker lookup localprocesses_tracker issue with spaces in process name/path in Splunk Enterprise Security

Local Processes Tracker lookup localprocesses_tracker issue with spaces in process name/path

vvanlier — Fri, 24 Jul 2026 10:05:05 GMT

The "Local Processes Tracker" from SA-EndpointProtection maintains a list of all processes on each system and the first and last time they were seen in localprocesses_tracker lookup.
The lookup gen search cut the process command after the first space.

| rex field=process "^\s*(?<process>[^\s]+)"

In case of Windows system, it mean for instance that all the processes started from a subfolder of C:\Program Files (x86) like "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" are seen as process "C:\Program in the lookup. And they are many other processes with space in the path that have a similar problem.
Would it be possible to improve the regular expression in that search to take in account strings with spaces between quotes?

Re: Local Processes Tracker lookup localprocesses_tracker issue with spaces in process name/path

livehybrid — Fri, 24 Jul 2026 12:17:44 GMT

Hi @vvanlier

Given that this is part of the Enterprise Security app/ecosystem, I would recommend opening a support case with Splunk for them to look into this as its unlikely to be picked up as a community post and we're not able to influence them directly.

Once you have raised with Splunk via support they should be able to assign it to the relevant internal team.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful

Marking it as the solution if it resolved your issue

Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

Re: Local Processes Tracker lookup localprocesses_tracker issue with spaces in process name/path

masonreed11 — Mon, 27 Jul 2026 05:11:50 GMT

Good catch. The current regex truncates quoted Windows paths at the first space, so supporting quoted strings would make the process extraction much more accurate. This would be a useful enhancement to raise with the maintainers.

Re: Local Processes Tracker lookup localprocesses_tracker issue with spaces in process name/path

vvanlier — Tue, 28 Jul 2026 09:19:44 GMT

FYI I followed your advise and opened a case to the support.