Splunk Search
Highlighted

How to extract and separate 2 fields from my sample data?

Path Finder

Hello,

I have this field in a WindowsEvent sourcetype in SPLUNK under the name "unparsed_message" and it contains some additional info and the info of my interest:

``````C:\Windows\System32\conhost.exe
C:\Windows\System32\cscript.exe
C:\Windows\System32\cmd.exe
C:\Windows\System32\dllhost.exe
C:\Program Files\LogSecUF\bin\splunkd.exe
``````

So these entries are taken from 5 separate events. What I would need is to extract to separate fields from the lines above “processpath” and “process”. So the “processpath” would indicate the path where the process starts (e.g. `C:\Windows\System32\`) and the “process” field would indicate the process itself (e.g. cscript.exe).

Any suggestions?

Thanks,
Kestutis

Tags (3)
Highlighted

Re: How to extract and separate 2 fields from my sample data?

SplunkTrust

Rex can do the job.

``````... | rex field=unparsed_message "(?P<process_path>.*)\\(?P<process>.*)\$" | ...
``````
---
If this reply helps you, an upvote would be appreciated.