topic Re: Rex for cef event and create field alias accordingly in Splunk Search https://community.splunk.com/t5/Splunk-Search/Rex-for-cef-event-and-create-field-alias-accordingly/m-p/393532#M114442 <P>Can provide some more information so that i will try to give some pointers?</P> <P>U can try like this </P> <P>"CEF" | extract pairdelim="{ }" kvdelim="=" | table shost src cs1 </P> Sat, 13 Jul 2019 11:07:56 GMT venkasplunk 2019-07-13T11:07:56Z Rex for cef event and create field alias accordingly https://community.splunk.com/t5/Splunk-Search/Rex-for-cef-event-and-create-field-alias-accordingly/m-p/393531#M114441 <P>sample CEF: </P> <PRE><CODE>May 20 20:44:51 10.XX.XX.XX May 20 2019 20:44:51 avcm02.com CEF:0|AV|Control Manager|7.0|BM:1000|Behavior Monitoring|3|rt=May 20 2019 03:34:47 GMT+00:00 dvchost=AV1 cn1Label=Risk_Level cn1=1 cs2Label=Policy cs2=1000 sproc=C:\\Windows\\System32\\taskeng.exe cn2Label=Event_Type cn2=1 cs1Label=Target cs1=C:\\Windows\\system32\\wscript.exe act=3 cn3Label=Operation cn3=101 shost=229Y9G2 src=10.XX.XX.XX deviceFacility=OfficeScan </CODE></PRE> <P>Our AV is forwarding multiple types of events, in the above mentioned "Behavior Monitoring " events, I want to convert the corresponding shost to field dhost . <BR /> How should I place it in props/transforms ?</P> Wed, 29 May 2019 04:45:51 GMT https://community.splunk.com/t5/Splunk-Search/Rex-for-cef-event-and-create-field-alias-accordingly/m-p/393531#M114441 ritikaviavi 2019-05-29T04:45:51Z Re: Rex for cef event and create field alias accordingly https://community.splunk.com/t5/Splunk-Search/Rex-for-cef-event-and-create-field-alias-accordingly/m-p/393532#M114442 <P>Can provide some more information so that i will try to give some pointers?</P> <P>U can try like this </P> <P>"CEF" | extract pairdelim="{ }" kvdelim="=" | table shost src cs1 </P> Sat, 13 Jul 2019 11:07:56 GMT https://community.splunk.com/t5/Splunk-Search/Rex-for-cef-event-and-create-field-alias-accordingly/m-p/393532#M114442 venkasplunk 2019-07-13T11:07:56Z Re: Rex for cef event and create field alias accordingly https://community.splunk.com/t5/Splunk-Search/Rex-for-cef-event-and-create-field-alias-accordingly/m-p/393533#M114443 <P>U can try like this</P> <P>"CEF" | extract pairdelim="{ }" kvdelim="=" | table shost src cs1 </P> Sat, 13 Jul 2019 11:08:10 GMT https://community.splunk.com/t5/Splunk-Search/Rex-for-cef-event-and-create-field-alias-accordingly/m-p/393533#M114443 venkasplunk 2019-07-13T11:08:10Z