Getting Data In

Splunk Datamodel Endpoint Processes.process_name: How do we fix the regex to only show process name?


We are having issues with our Splunk datamodel Endpoint Processes.process_name. The current value for Process.process_name is...

case(isnotnull(process) AND parent_process!="",replace(process,".*\\\\(.*)","\1"),1=1,"unknown")

The regex pulls correct and invalid results as follows...




BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
RuntimeBroker.exe -Embedding

The correct results show the actual process name while the incorrect ones may not show the process name or shows the process name with an extra quotation mark or command line arguments.

How do we fix the regex to only show process name?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...