topic Re: Help - Extract file name from the below raw data in Splunk Search

How to extract file name from the below raw data?

danroberts — Fri, 15 Sep 2023 18:03:07 GMT

Hello,

Can anyone help me to extract the below file name which is OU_..... from the below raw data.

12:04:19.85 14/09/2023 directory="E:\data\Test" ECHO is off.

Volume in drive E is Data Volume Serial Number is 7808-CA1B

Directory of E:\data\Test 13/09/2023 13:22

<DIR> XXX\xxxx . 13/09/2023 13:22 <DIR> xxx\xxx .. 12/09/2023 09:31 95 xxx\xxx dir_details.bat 13/09/2023 13:41 171 xxx\xxx dir_details_copy.bat 07/09/2023 13:26 0 xxx\xxx edsadsad.txt 07/09/2023 13:26 22 xxx\xxx OU_kljdajdklsajkdl.zip 07/09/2023 13:26 22 xxx\xxx OU_kljdajdklsajkewew.zip 07/09/2023 13:26 22 xxx\xxx OU_kljdajdklsajkewewdsads.zip 6 File(s) 332 bytes 2 Dir(s) 20718067712 bytes free

Re: Help - Extract file name from the below raw data

gcusello — Thu, 14 Sep 2023 11:31:03 GMT

Hi @danroberts,

please try this:

| rex "(?<filename>OU_\w*\.\w*"

that you can test at https://regex101.com/r/UiiMSA/1

Ciao.

Giuseppe

Re: Help - Extract file name from the below raw data

ITWhisperer — Thu, 14 Sep 2023 11:32:17 GMT

Try something like this:

| rex max_match=0 "\s+\S+\s+\S+\s+\S+\s+\S+\s+(?<file>OU_\S+)"

In future, please paste the text of your event into a code block </> much like I have done with the SPL above. This prevents the text from being reformatted and losing spaces and new lines etc.

Re: Help - Extract file name from the below raw data

danroberts — Thu, 14 Sep 2023 12:30:27 GMT

Thanks for the reply, unfortunately this just pulls out one of the OU file names.

Re: Help - Extract file name from the below raw data

danroberts — Thu, 14 Sep 2023 12:31:53 GMT

Thanks for the rely, this has worked.

Would this also work in a props.conf file ?

I'm utilising a universal forwarder with a bat script to pull the data from the directory.

Re: Help - Extract file name from the below raw data

ITWhisperer — Thu, 14 Sep 2023 12:32:07 GMT

This is what you asked for

Re: Help - Extract file name from the below raw data

gcusello — Thu, 14 Sep 2023 13:11:26 GMT

Hi @danroberts,

please try this:

| rex max_match=0 "(?<filename>OU_\w*\.\w*"

Ciao.

Giuseppe

Re: Help - Extract file name from the below raw data

gcusello — Mon, 18 Sep 2023 09:46:33 GMT

Hi @danroberts ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉