topic Re: Use eval command to extract from message in Splunk Search

Use eval command to extract from message

jeradb — Thu, 29 Feb 2024 13:49:48 GMT

LogName=Application EventCode=1004 EventType=4 ComputerName=Test.local User=NOT_TRANSLATED Sid=S-1-5-21-2704069758-3089908202-2921546158-1104 SidType=0 SourceName=RoxioBurn Type=Information RecordNumber=16834 Keywords=Classic TaskCategory=Optical Disc OpCode=Info Message=Date: Wed Feb 28 14:22:59 2024 Computer Name: COM-HV01 User Name: Test\test.user Writing is completed on drive (E:). Project includes 0 folder(s) and 1 file(s). Volume Label: 2024-02-28 Volume SN: 0 Volume ID: \??\Volume{b282bf1c-3dde-11ed-b48e-806e6f6e6963} Type: Unknown Status Of Media: Appendable,Blank,Closed session Files: C:\ProgramData\Roxio Log Files\Test.test.user_20240228142142.txt SHA1: 7c347a6724dcd243d396f9bb5e560142f26b8aa4 File System: None Disc Number: 1 Encryption: Yes User Password: Yes Spanned Set: No Data Size On Disc Set: 511 Bytes Network Volume: No

How would I write an eval command to extract User Name: without domain, Status of Media, Data size on disc set, and files from the field Message?

Re: Use eval command to extract from message

gcusello — Thu, 29 Feb 2024 14:00:23 GMT

Hi @jeradb,

you could use a regex, not an eval command like the following:

| rex "User Name: (?<User_Name>[^ \n]+)"

you can test this regex at https://regex101.com/r/gJ0I26/1

But only one question: did you installed the Splunk_TA_Windows (https://splunkbase.splunk.com/app/742)?

using this add-on you should already have this field extracted without using a custom regex.

Ciao.

Giuseppe

Re: Use eval command to extract from message

gcusello — Wed, 06 Mar 2024 07:31:33 GMT

Hi @jeradb,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉