Splunk Search

How to extract particular matching string value in Splunk

Jagat
Engager

I want to extract only the process name value from the logs and store in a table:

Input Log:
-------------
<30>1 2023-12-13T06:22:20.197Z 10.205.101.94 4 CGA3001I [sev="INFO" msg="Event" event="Data is getting from process name: C:\\ProgramFiles\\notepad.exe. Now we can try to write the logs. Mode: Operational"]

Output:
----------

C:\\ProgramFiles\\notepad.exe

I have tried with the command :- regex "(?<=Process name:).*?(?=\.\s+)" | table Process
But didn't get any data

Labels (3)
0 Karma

Jagat
Engager

I want to show only identical process name values in the table "Process" because these logs come in  repeated format. If any other process name value is different from notepad.exe then it can logged in the "Process" table otherwise it can be skipped.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Just add this the end of query

| where Process != "C:\\ProgramFiles\\notepad.exe"
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If this always ended with ". Now" then you can use 

...
| rex "from process name: (?<Process>.+)\. Now"
| table Process

If there can be anything then this is not working and you must use something else based on the rest of line.

r. Ismo 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Jagat,

this regex works for the sample you shared (without spaces in the process name and path).

| rex "process name:\s+(?<process_name>[^ ]+)"

that you can test at https://regex101.com/r/b1oavF/1 

To be more sure, you shoud share more and different samples.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...