topic Re: Regex Source and Destination files with path, filename, extension in Splunk Search

Regex Source and Destination files with path, filename, extension

kent_farries — Tue, 29 Sep 2020 11:33:02 GMT

I need some help with this one since it is beyond my regex skills which are not the best. I would have used the field extractor but the data does not show up to extract. The data comes from a tool called Varonis DatAlert and is stored in the Windows Event log and we want to be able to use this for custom Ransomware alerting.

The field from the Windows Event log called Additional_Data and I would like to extract it into 6 fields.

Additional_Data Sample
I:\Dept3\folder1\folder two\folder 3\folder 4\Filename1.htm changed to I:\Dept3\folder1\folder two\folder 3\folder 4\Filename1.txt

Desired Fields
source_path = I:\Dept3\folder1\folder two\folder 3\folder 4
source_file = Filename1.htm
source_type = htm
dest_path = I:\Dept3\folder1\folder two\folder 3\folder 4
dest_file = Filename1.txt
dest_type = txt

Thanks in advance

Re: Regex Source and Destination files with path, filename, extension

javiergn — Tue, 25 Oct 2016 15:00:20 GMT

It should be something like this if I'm not mistaken:

| rex field=Additional_Data  "^(?<source_path>.+?)\\\(?<source_file>[^\\\]+) changed to (?<dest_path>.+?)\\\(?<dest_file>[^\\\]+)$"
| rex field=source_file "\.(?<source_type>[^\.]+)$"
| rex field=dest_file "\.(?<dest_type>[^\.]+)$"

This is the way I tested it in my lab:

| stats count | fields - count
| eval Additional_Data ="I:\\Dept3\\folder1\\folder two\\folder 3\\folder 4\\Filename1.htm changed to I:\\Dept3\\folder1\\folder two\\folder 3\\folder 4\\Filename1.txt"
| rex field=Additional_Data  "^(?<source_path>.+?)\\\(?<source_file>[^\\\]+) changed to (?<dest_path>.+?)\\\(?<dest_file>[^\\\]+)$"
| rex field=source_file "\.(?<source_type>[^\.]+)$"
| rex field=dest_file "\.(?<dest_type>[^\.]+)$"

Output (see picture below):

Re: Regex Source and Destination files with path, filename, extension

gokadroid — Tue, 25 Oct 2016 15:00:27 GMT

can you try below:

yourBaseQuery
| rex field=Additional_Data "(?<source_path>.*\\)(?<sFileName>[^\.]+)\.(?<source_type>[^\s]+)\schanged\sto\s(?<dest_path>.*\\)(?<dFileName>[^\.]+)\.(?<dest_type>[^\s]+)"
| eval source_file=sFileName.".".source_type
|eval dest_file=dFileName.".".dest_type
| table Additional_Data, source_path, source_file, source_type, dest_path, dest_file, dest_type

Re: Regex Source and Destination files with path, filename, extension

richgalloway — Tue, 25 Oct 2016 15:04:58 GMT

This works with your sample data.

... | rex field=Additional_Data "(?<source_path>.*?)\\(?<source_file>[^ ]+\.(?<source_type>\w+)) changed to (?<dest_path>.*)\\(?<dest_file>.+?\.(?<dest_type>\w+))$" | ...

Re: Regex Source and Destination files with path, filename, extension

somesoni2 — Tue, 25 Oct 2016 15:06:38 GMT

Since you want to extract this field from an existing field (Additional_Data), you'd have to to use Field Transforms.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Create_advanced_search-time_field_extractions_with_field_transforms

May something like this would work

props.conf (on Search Head)

[yourWinEventLogsourcetype]
REPORT-fromadditionaldata = additional_data_fields

transforms.conf (on Search Head)

[additional_data_fields]
SOURCE_KEY = Additional_Data
REGEX = (?<source_path>.+\\\(?<source_file>[^\.]+)\.(?<source_type>\S+)) changed to (?<dest_path>.+\\\(?<dest_file>[^\.]+)\.(?<dest_type>\S+)

Re: Regex Source and Destination files with path, filename, extension

kent_farries — Tue, 25 Oct 2016 21:45:45 GMT

Thank you so much for all the answers you guys are awesome.

I have one of them working right now and have tested a couple of the others but was not able to get them fully working yet. I will go through all of them after work.

I do like the props and transforms as well but based on two of my tests it did not work yet and I'm probably doing something wrong. I used them in my app on the search head but the fields did not show up and I have not tried to troubleshoot it yet.

Once again, thanks!!!

Re: Regex Source and Destination files with path, filename, extension

kent_farries — Tue, 25 Oct 2016 21:46:04 GMT

Thanks worked first try.