https://community.splunk.com/t5/Splunk-Search/How-to-extract-and-separate-2-fields-from-my-sample-data/m-p/173239#M49666 <P>Rex can do the job.</P> <PRE><CODE>... | rex field=unparsed_message "(?P&lt;process_path&gt;.*)\\(?P&lt;process&gt;.*)$" | ... </CODE></PRE> Tue, 10 Mar 2015 13:45:08 GMT richgalloway 2015-03-10T13:45:08Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-and-separate-2-fields-from-my-sample-data/m-p/173238#M49665 <P>Hello,</P> <P>I have this field in a WindowsEvent sourcetype in SPLUNK under the name "unparsed_message" and it contains some additional info and the info of my interest:</P> <PRE><CODE>C:\Windows\System32\conhost.exe C:\Windows\System32\cscript.exe C:\Windows\System32\cmd.exe C:\Windows\System32\dllhost.exe C:\Program Files\LogSecUF\bin\splunkd.exe </CODE></PRE> <P>So these entries are taken from 5 separate events. What I would need is to extract to separate fields from the lines above “process_path” and “process”. So the “process_path” would indicate the path where the process starts (e.g. <CODE>C:\Windows\System32\</CODE>) and the “process” field would indicate the process itself (e.g. cscript.exe). </P> <P>Any suggestions?</P> <P>Thanks,<BR /> Kestutis</P> Mon, 28 Sep 2020 19:08:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-and-separate-2-fields-from-my-sample-data/m-p/173238#M49665 kestasm 2020-09-28T19:08:46Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-and-separate-2-fields-from-my-sample-data/m-p/173239#M49666 <P>Rex can do the job.</P> <PRE><CODE>... | rex field=unparsed_message "(?P&lt;process_path&gt;.*)\\(?P&lt;process&gt;.*)$" | ... </CODE></PRE> Tue, 10 Mar 2015 13:45:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-and-separate-2-fields-from-my-sample-data/m-p/173239#M49666 richgalloway 2015-03-10T13:45:08Z