Splunk Search

Extract multiple file names from email attachments

Explorer

Trying to extract all email attachments file names. I am no good with Rex/Regex, so I used the automatic extraction in Splunk... However, the extraction is only pulling the first file name, never anything after.

In Splunk on the Extraction/Transfor, field I got
(?=[^"](?:"filename":|"."filename":))^[^/\n]*/\w+",\s+"\w+":\s+"(?P[^"]+)

Need to know what to add in order for it to loop through for each attachment.

0 Karma

Explorer

Sorry all, completely forgot about it. Still an issue, but I don't have time to deal with it at this point. If I can delete the question, I will.

0 Karma

Contributor

Hi,
Can you please share sample logs? Also, if your rex is working fine then can you try adding max_match = 0 after the rex which will help you in looping through each attachment.

0 Karma

Champion

Hi,

You need to provide us a sample of your logs. One suggestion - your regex is probably not working. You need to write your own regex and not depend on extract from splunk web, If you do provide us a some samples we can surely help you on this

0 Karma

SplunkTrust
SplunkTrust

Please share some sample log entries. You probably need to user Field transform in order to capture multiple values (creating multivalued field).

SplunkTrust
SplunkTrust

@biers04 - is this still an issue? If so, please post some non-confidential samples of the events you are trying to extract. When you post the data, or when you post code, please be sure to mark it with the code button (101 010) or surround it with grave accents (the ones on the tilde key ~), or put at least four spaces before each line, so that the interface will not treat html-like data as html or xml code.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!