Splunk Enterprise Security

How to trim the results for attachment?

NDabhi21
Explorer

Hi Team,

I would like to drop/trim .png and .jpg files in the output result.

will be appreciated if you could help with regex or any other idea and solution.

Labels (1)
Tags (1)
0 Karma

woodcock
Esteemed Legend

Add this:

... | where not match(file, "\.(jpg|png)$")

0 Karma

NDabhi21
Explorer

Hi Woodcock,

 

This is no working , command syntax is not accepted  

0 Karma

woodcock
Esteemed Legend

Works for me:

|makeresults
| eval file="foo.exe"
| where not match(file, "\.(jpg|png)$")

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability - November 2025

Feature Highlight  Analyze your dimensions and metrics with Usage Analytics  To help optimize telemetry data ...

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...