Splunk Enterprise Security

Extract file hash from field

New Member

I have a field which contains various data, one of the data is the file hash. I would like to extract it to a field.

Tue Jul 15 09:32:03 CET 2019 app=testapp file_hash=aaaaaaaaaaaaaaaa1234567890123456 os=linux

I would like to extract the file_hash: 32 chars only letters and numbers.

Many thanks.

0 Karma


This should do it.

... | rex field=foo "file_hash=(?<file_hash>.{32})" | ...
If this reply helps you, Karma would be appreciated.
0 Karma

New Member

Hi Gyr1991,
I can provide following regex


or just for the letters and numbers:


You can use one of them in the fields-extractor of splunk.

Hope this helps 🙂

Kind Regards,

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...