Monitoring Splunk

Windows Security logs and USB Monitoring

rduro
New Member

Dear All,

I'm trying to find a way to catch the number 0018F3D97D02BBA0517E001A&0 which before the last backslash.

I put an extract of the line I want to a reg on it.

Object Name:    \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_Kingston&Prod_DT_R500&Rev_PMAP\0018F3D97D02BBA0517E001A&0

The reg command I used is the following:

| rex field=_raw "USBSTOR.*_(?<USBID>......?)"|

I just want to extract all data after the last backslash.

Please help,

Best regards,

Raph

Tags (2)
0 Karma

Ayn
Legend

If that code is the last text in the event, how about:

| rex "(?<USBID>[^\\]+)$"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...