Hello,
I need help with extracting specific data from logs. I know this has been discussed few times before but if anyone has worked on powershell logs, you will see that it comes with lot of data. Even doing simple get process at shell gives you information like below(example1)and scripts and other more complicated commands give lot more data(example2).
What I want to do it only display the commands that were run. Meaning, extract just the commands in below text and disaplay as table or list in splunk. How do I do this? I already have regex that will catch powershell's verb-noun combo like this - [a-zA-Z]{3,}-[a-zA-Z]{3,} - this will match any powershell command. But how do I extract just the command from lot of junk and display only PS commands and its switches and values?
Example 1) Creating Scriptblock text (1 of 1): get-process -Name explorer.exe
ID: abc1234-8539-44xy-a16d-0492bfbd0d61 Path:
Exmaple2)
Creating Scriptblock text (1 of 1):
For ($x in $y) {
get-process -Name Explorer.exe
write-host $x
}
ID: abc1234-8539-44xy-a16nn-0492mnod0d61 Path:
