Splunk Search

How to extract particular matching string value in Splunk

Jagat
Engager

I want to extract only the process name value from the logs and store in a table:

Input Log:
-------------
<30>1 2023-12-13T06:22:20.197Z 10.205.101.94 4 CGA3001I [sev="INFO" msg="Event" event="Data is getting from process name: C:\\ProgramFiles\\notepad.exe. Now we can try to write the logs. Mode: Operational"]

Output:
----------

C:\\ProgramFiles\\notepad.exe

I have tried with the command :- regex "(?<=Process name:).*?(?=\.\s+)" | table Process
But didn't get any data

Labels (3)
0 Karma

Jagat
Engager

I want to show only identical process name values in the table "Process" because these logs come in  repeated format. If any other process name value is different from notepad.exe then it can logged in the "Process" table otherwise it can be skipped.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Just add this the end of query

| where Process != "C:\\ProgramFiles\\notepad.exe"
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If this always ended with ". Now" then you can use 

...
| rex "from process name: (?<Process>.+)\. Now"
| table Process

If there can be anything then this is not working and you must use something else based on the rest of line.

r. Ismo 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Jagat,

this regex works for the sample you shared (without spaces in the process name and path).

| rex "process name:\s+(?<process_name>[^ ]+)"

that you can test at https://regex101.com/r/b1oavF/1 

To be more sure, you shoud share more and different samples.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...