Splunk Enterprise Security

Extract file hash from field

gyr1991
New Member

I have a field which contains various data, one of the data is the file hash. I would like to extract it to a field.

Tue Jul 15 09:32:03 CET 2019 app=testapp file_hash=aaaaaaaaaaaaaaaa1234567890123456 os=linux

I would like to extract the file_hash: 32 chars only letters and numbers.

Many thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should do it.

... | rex field=foo "file_hash=(?<file_hash>.{32})" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

jutzasconsist
New Member

Hi Gyr1991,
I can provide following regex

file_hash\=(?<EXTRACTION1>\w+)\s+

or just for the letters and numbers:

file_hash\=(?<EXTRACTION1>[[:alnum:]]+)\s+

You can use one of them in the fields-extractor of splunk.

Hope this helps 🙂

Kind Regards,
Michael

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...