How to extract particular matching string value in Splunk

[Jagat]

I want to extract only the process name value from the logs and store in a table:

Input Log:
-------------
<30>1 2023-12-13T06:22:20.197Z 10.205.101.94 4 CGA3001I [sev="INFO" msg="Event" event="Data is getting from process name: C:\\ProgramFiles\\notepad.exe. Now we can try to write the logs. Mode: Operational"]

Output:
----------

C:\\ProgramFiles\\notepad.exe

I have tried with the command :- regex "(?<=Process name:).*?(?=\.\s+)" | table Process
But didn't get any data

[Jagat]

I want to show only identical process name values in the table "Process" because these logs come in  repeated format. If any other process name value is different from notepad.exe then it can logged in the "Process" table otherwise it can be skipped.

[isoutamo]

Just add this the end of query

| where Process != "C:\\ProgramFiles\\notepad.exe"

[isoutamo]

Hi

If this always ended with ". Now" then you can use 

...
| rex "from process name: (?<Process>.+)\. Now"
| table Process

If there can be anything then this is not working and you must use something else based on the rest of line.

r. Ismo 

[gcusello]

Hi @Jagat,

this regex works for the sample you shared (without spaces in the process name and path).

| rex "process name:\s+(?<process_name>[^ ]+)"

that you can test at https://regex101.com/r/b1oavF/1 

To be more sure, you shoud share more and different samples.

Ciao.

Giuseppe