Splunk Search

How can I extract these file names that are in the same event?

daniel333
Builder

Hi all,

I have a file that looks like this -

Added files:
added: /etc/addedthisfile
added: /etc/cron.daily/tripwire-check
added: /etc/tripwire

How can field extract added=*?

0 Karma
1 Solution

somesoni2
Revered Legend

In search you can do like this (in-line field extraction: extracting field 'Files' as multivalued field which contains all paths)

your base search | rex max_match=0 "added: (?<Files>\S+)"

To do that automatically (saved field extraction), you can follow this

https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/ConfigureSplunktoparsemulti-valuefields
OR
https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Exampleconfigurationsusingfieldtransfor...

View solution in original post

somesoni2
Revered Legend

In search you can do like this (in-line field extraction: extracting field 'Files' as multivalued field which contains all paths)

your base search | rex max_match=0 "added: (?<Files>\S+)"

To do that automatically (saved field extraction), you can follow this

https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/ConfigureSplunktoparsemulti-valuefields
OR
https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Exampleconfigurationsusingfieldtransfor...

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!