Splunk Enterprise Security

Extract file hash from field

New Member

I have a field which contains various data, one of the data is the file hash. I would like to extract it to a field.

Tue Jul 15 09:32:03 CET 2019 app=testapp file_hash=aaaaaaaaaaaaaaaa1234567890123456 os=linux

I would like to extract the file_hash: 32 chars only letters and numbers.

Many thanks.

0 Karma


This should do it.

... | rex field=foo "file_hash=(?<file_hash>.{32})" | ...
If this reply helps you, Karma would be appreciated.
0 Karma

New Member

Hi Gyr1991,
I can provide following regex


or just for the letters and numbers:


You can use one of them in the fields-extractor of splunk.

Hope this helps 🙂

Kind Regards,

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...