topic Re: Extracting Attachments in Splunk Search

How can I extract attachments?

treven — Fri, 28 Jul 2023 16:08:11 GMT

I am attempting to extract attachment fields from our email logs using regex. Attachments like .jpg, .png, pdf, etc. I have gone through the process of using the SPL field extracting feature however it usually results in only one attachment type being selected or another, if I try and select other attachment types the extraction fails. Any suggestions would be greatly appreciated. Thank you.

Re: Extracting Attachments

gcusello — Fri, 28 Jul 2023 13:33:50 GMT

Hi @treven,

I suppose that you're speaking to extract the file name of the attachment, not the attachment file itself!

Anyway, the field extraction should already be present in the Add-On you're using, if not, please share a sample of your logs, highlighting in bold the data to extract.

Ciao.

Giuseppe

Re: Extracting Attachments

treven — Fri, 28 Jul 2023 13:52:44 GMT

Yes that is correct I am just looking to monitor the various types of attachment types. As I stated in my post, the field extracting feature is only allowing one type of attachment. It will only extract .jpg fields and will ignore pdf or png. If I try to add another by selecting it in an event, I will get an error.

Re: Extracting Attachments

gcusello — Fri, 28 Jul 2023 13:54:38 GMT

Hi @treven,

ok, could you share a sample (in text format) of your logs (eventually masking data)?

Ciao.

Giuseppe

Re: Extracting Attachments

treven — Fri, 28 Jul 2023 13:57:20 GMT

Yeah absolutely, I will post it soon. Thanks for your assistance.

Re: Extracting Attachments

treven — Fri, 28 Jul 2023 15:05:47 GMT

So, I was able to get the field extractor to do both png and jpg but any other selected field results in an error. I suppose I could create separate fields and use eval to somewhat accomplish what I am looking for.

Here are some examples:

date=2023-07-28 time=09:00:22.791 device_id=10000 log_id=000123 type=spam subtype=default pri=information session_id="1138-7644" client_name="" client_ip="1.1.1.1" dst_ip="1.1.1.1" from="email" to="email" subject="TITLE" msg="Antispam identified spam URL: http://website.jpg"

date=2023-07-28 time=08:51:25.640 device_id=02222 log_id=00023 type=virus subtype=sandbox pri=information from="" to="" client_name="" client_ip="" session_id="1000-0322" msg="File file.pdf has been sent to Sandbox"

Re: Extracting Attachments

gcusello — Fri, 28 Jul 2023 15:14:52 GMT

Hi @treven,

maybe this regex could work for you:

| rex "(?<file>\w+\.(jpg|pdf|png))"

that you can test at https://regex101.com/r/ol040L/1

Ciao.

Giuseppe

Re: Extracting Attachments

treven — Fri, 28 Jul 2023 15:32:13 GMT

@gcusello

That did it! Thank you very much for your assistance with this!

Re: Extracting Attachments

treven — Fri, 28 Jul 2023 15:34:03 GMT

@gcusello ,

This worked really well! Thank you very much for your assistance!