Splunk Search

Filtering substring content

RedHonda03
Explorer

I have a search which looks at rare events in Windows Event Logs and provides output shown below.

source="winevtlog:security" EventCode=4688 | rare limit=50 New_Process_Name

Log-1.jpg

I've been unsuccessful in filtering these results further, such as searching for programs running from a Temp folder, or other non-standard folders. Looking under the 'match_regex(input, pattern)' section in the https://docs.splunk.com/Documentation/DSP/1.2.1/FunctionReference/Stringmanipulation documentation has one example, but I'm not able to figure out how to modify the example to fit my search. For example, reducing the search to only show VMware processes. Below is an attempt I made, which gave me: Error in 'where' command: The expression is malformed. An unexpected character is reached at '/VMware/);'.

source="winevtlog:security" EventCode=4688 | rare limit=50 New_Process_Name | where match_regex(cast(New_Process_Name, "string"), /VMware/);

The documentation mentions using the RegEx Start and End characters ^ $, but I get the same error listed above.  I've looked at several other posts here below, but haven't been able to find a good example that fits.

https://community.splunk.com/t5/Splunk-Search/Search-for-a-string-containing-X/m-p/120450

https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-where-if-a-certain-string-is-fou...

https://community.splunk.com/t5/Splunk-Search/How-to-match-and-filter-by-substr/m-p/155912#M43866

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you doing this in a search or dashboard query? If so, try it like this

source="winevtlog:security" EventCode=4688 | rare limit=50 New_Process_Name | where match(New_Process_Name, "VMware")
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...