Splunk Search

How can I extract attachments?

treven
Explorer

I am attempting to extract attachment fields from our email logs using regex. Attachments like .jpg, .png, pdf, etc. I have gone through the process of using the SPL field extracting feature however it usually results in only one attachment type being selected or another, if I try and select other attachment types the extraction fails. Any suggestions would be greatly appreciated. Thank you. 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @treven,

maybe this regex could work for you:

| rex "(?<file>\w+\.(jpg|pdf|png))"

that you can test at https://regex101.com/r/ol040L/1

Ciao.

Giuseppe

View solution in original post

treven
Explorer

@gcusello 

That did it! Thank you very much for your assistance with this! 

0 Karma

treven
Explorer
So, I was able to get the field extractor to do both png and jpg but any other selected field results in an error. I suppose I could create separate fields and use eval to somewhat accomplish what I am looking for. 
 
 
Here are some examples: 
 
date=2023-07-28 time=09:00:22.791 device_id=10000 log_id=000123 type=spam subtype=default pri=information  session_id="1138-7644" client_name="" client_ip="1.1.1.1" dst_ip="1.1.1.1" from="email" to="email" subject="TITLE" msg="Antispam identified spam URL: http://website.jpg"



 

date=2023-07-28 time=08:51:25.640 device_id=02222 log_id=00023 type=virus subtype=sandbox pri=information  from="" to="" client_name="" client_ip="" session_id="1000-0322" msg="File file.pdf has been sent to Sandbox"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @treven,

maybe this regex could work for you:

| rex "(?<file>\w+\.(jpg|pdf|png))"

that you can test at https://regex101.com/r/ol040L/1

Ciao.

Giuseppe

treven
Explorer

@gcusello ,

 

This worked really well! Thank you very much for your assistance!

0 Karma

treven
Explorer

Yeah absolutely, I will post it soon. Thanks for your assistance. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @treven,

I suppose that you're speaking to extract the file name of the attachment, not the attachment file itself!

Anyway, the field extraction should already be present in the Add-On you're using, if not, please share a sample of your logs, highlighting in bold the data to extract.

Ciao.

Giuseppe

treven
Explorer

Yes that is correct I am just looking to monitor the various types of attachment types. As I stated in my post, the field extracting feature is only allowing one type of attachment. It will only extract .jpg fields and will ignore pdf or png. If I try to add another by selecting it in an event, I will get an error. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @treven,

ok, could you share a sample (in text format) of your logs (eventually masking data)?

Ciao.

Giuseppe

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...