Splunk Search

How to extract particular matching string value in Splunk

Jagat
Engager

I want to extract only the process name value from the logs and store in a table:

Input Log:
-------------
<30>1 2023-12-13T06:22:20.197Z 10.205.101.94 4 CGA3001I [sev="INFO" msg="Event" event="Data is getting from process name: C:\\ProgramFiles\\notepad.exe. Now we can try to write the logs. Mode: Operational"]

Output:
----------

C:\\ProgramFiles\\notepad.exe

I have tried with the command :- regex "(?<=Process name:).*?(?=\.\s+)" | table Process
But didn't get any data

Labels (3)
0 Karma

Jagat
Engager

I want to show only identical process name values in the table "Process" because these logs come in  repeated format. If any other process name value is different from notepad.exe then it can logged in the "Process" table otherwise it can be skipped.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Just add this the end of query

| where Process != "C:\\ProgramFiles\\notepad.exe"
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If this always ended with ". Now" then you can use 

...
| rex "from process name: (?<Process>.+)\. Now"
| table Process

If there can be anything then this is not working and you must use something else based on the rest of line.

r. Ismo 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Jagat,

this regex works for the sample you shared (without spaces in the process name and path).

| rex "process name:\s+(?<process_name>[^ ]+)"

that you can test at https://regex101.com/r/b1oavF/1 

To be more sure, you shoud share more and different samples.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...