Regex in transforms.conf

TheBravoSierra — Wed, 09 Jun 2021 22:39:04 GMT

I'm trying to get this extraction for the filename to work via transforms.conf but it isn't working. Any ideas?

[My_source_type]

REPORT-file= extract_file

[extract_file]

REGEX =<Data Name='TargetFilename'>.*\\\\(?<file>[\S\s+]*)<\/Data>

FORMAT = file:$3

<Event xmlns='omitted><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{omitted}'/><EventID>2</EventID><Version>4</Version><Level>4</Level><Task>2</Task><Opcode>0</Opcode><Keywords>omitted</Keywords><TimeCreated SystemTime='2021-06-09T16:31:46.813927400Z'/><EventRecordID>947063</EventRecordID><Correlation/><Execution ProcessID='4824' ThreadID='6932'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>omitted</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'></Data><Data Name='UtcTime'>2021-06-09 16:31:46.813</Data><Data Name='ProcessGuid'>{omitted}</Data><Data Name='ProcessId'>11932</Data><Data Name='Image'>C:\Users\omitted\AppData\Local\Microsoft\Teams\current\Teams.exe</Data><Data Name='TargetFilename'>C:\Users\omitted\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EJ5T0WEDS801S4OF2UEY.temp</Data><Data Name='CreationUtcTime'>2020-04-21 21:00:25.187</Data><Data Name='PreviousCreationUtcTime'>2021-06-09 16:31:46.802</Data></EventData></Event>

Re: Regex in transforms.conf

t_shreya — Thu, 10 Jun 2021 04:45:29 GMT

Hi @TheBravoSierra ,

Can you check if the following works?
<Data Name='TargetFilename'>.*\\(?<file>[\S\s+]*)<\/Data>

Re: Regex in transforms.conf

venkatasri — Thu, 10 Jun 2021 05:27:53 GMT

Hi @TheBravoSierra

[My_source_type] REPORT-file= extract_file [extract_file] REGEX = \<Data Name\=\'TargetFilename\'\>.*\\(?<file>[^<]+) FORMAT = file::$1

-----

An upvote would be appreciated if it helps!

topic Regex in transforms.conf in Splunk Search

Regex in transforms.conf

Re: Regex in transforms.conf

Re: Regex in transforms.conf