How to extract file name from the below raw data?

[danroberts]

Hello, 

Can anyone help me to extract the below file name which is OU_..... from the below raw data. 

12:04:19.85 14/09/2023 directory="E:\data\Test" ECHO is off.

Volume in drive E is Data Volume Serial Number is 7808-CA1B

Directory of E:\data\Test 13/09/2023 13:22

<DIR> XXX\xxxx . 13/09/2023 13:22 <DIR> xxx\xxx .. 12/09/2023 09:31 95 xxx\xxx  dir_details.bat 13/09/2023 13:41 171 xxx\xxx  dir_details_copy.bat 07/09/2023 13:26 0 xxx\xxx  edsadsad.txt 07/09/2023 13:26 22 xxx\xxx  OU_kljdajdklsajkdl.zip 07/09/2023 13:26 22 xxx\xxx  OU_kljdajdklsajkewew.zip 07/09/2023 13:26 22 xxx\xxx  OU_kljdajdklsajkewewdsads.zip 6 File(s) 332 bytes 2 Dir(s) 20718067712 bytes free

[ITWhisperer · Accepted solution]

Try something like this:

| rex max_match=0 "\s+\S+\s+\S+\s+\S+\s+\S+\s+(?<file>OU_\S+)"

In future, please paste the text of your event into a code block </> much like I have done with the SPL above. This prevents the text from being reformatted and losing spaces and new lines etc.

[danroberts]

Thanks for the rely, this has worked. 

Would this also work in a props.conf file ? 

I'm utilising a universal forwarder with a bat script to pull the data from the directory. 

[gcusello]

Hi @danroberts ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

Hi @danroberts,

please try this:

| rex "(?<filename>OU_\w*\.\w*"

that you can test at https://regex101.com/r/UiiMSA/1

Ciao.

Giuseppe

[danroberts]

Thanks for the reply, unfortunately this just pulls out one of the OU file names. 

[gcusello]

Hi @danroberts,

please try this:

| rex max_match=0 "(?<filename>OU_\w*\.\w*"

Ciao.

Giuseppe

[ITWhisperer]

This is what you asked for