Splunk Search
Highlighted

How to extract and separate 2 fields from my sample data?

Path Finder

Hello,

I have this field in a WindowsEvent sourcetype in SPLUNK under the name "unparsed_message" and it contains some additional info and the info of my interest:

C:\Windows\System32\conhost.exe
C:\Windows\System32\cscript.exe
C:\Windows\System32\cmd.exe
C:\Windows\System32\dllhost.exe
C:\Program Files\LogSecUF\bin\splunkd.exe

So these entries are taken from 5 separate events. What I would need is to extract to separate fields from the lines above “processpath” and “process”. So the “processpath” would indicate the path where the process starts (e.g. C:\Windows\System32\) and the “process” field would indicate the process itself (e.g. cscript.exe).

Any suggestions?

Thanks,
Kestutis

0 Karma
Highlighted

Re: How to extract and separate 2 fields from my sample data?

SplunkTrust
SplunkTrust

Rex can do the job.

... | rex field=unparsed_message "(?P<process_path>.*)\\(?P<process>.*)$" | ...
---
If this reply helps you, an upvote would be appreciated.