How to extract and separate 2 fields from my sample data?

[kestasm]

Hello,

I have this field in a WindowsEvent sourcetype in SPLUNK under the name "unparsed_message" and it contains some additional info and the info of my interest:

C:\Windows\System32\conhost.exe
C:\Windows\System32\cscript.exe
C:\Windows\System32\cmd.exe
C:\Windows\System32\dllhost.exe
C:\Program Files\LogSecUF\bin\splunkd.exe

So these entries are taken from 5 separate events. What I would need is to extract to separate fields from the lines above “process_path” and “process”. So the “process_path” would indicate the path where the process starts (e.g. C:\Windows\System32\) and the “process” field would indicate the process itself (e.g. cscript.exe).

Any suggestions?

Thanks,
Kestutis

[richgalloway]

Rex can do the job.

... | rex field=unparsed_message "(?P<process_path>.*)\\(?P<process>.*)$" | ...