How to extract 'program.exe -switch' from the log and create new field to display with table command

[nnaik]

Hey guys,

I have a log that contains a lot of data but from that, I want to extract 'program.exe -switch' from the log and create a new field that I can display with table command. I have regex ready and confirmed on regex101.com. But I tried some of the below in my search and no luck. I've looked up rex command and examples on answers.splunk.com as well. But not sure how I can use rex command in this case.

....regex cmd="/^(\s\w\D*.\D*\s\D*\d)$/" | table cmd
....regex cmd="\s\w\D*.\D*\s\D*\d" | table cmd
....regex cmd="\s\w\D*.\D*\s\D*\d" | table cmd

Any ideas how I can get this data?

[nnaik]

Thank you all!

Rich Galloway, Your solution works. Thank you! Essentially, I wanted to extract just specific data from logs and create table of this extracted data only so that my reports are clean looking. Only change I made is put \w in beginning of each word so if someone typed caps or lowercase, it would be captured.

| rex "(?\wrogram.exe -\wwitch \wroperty)" | table cmd

Thanks again!

[richgalloway · Accepted solution]

This may be too simplistic of an answer, but I think it addresses the question. Your regular expression is far too complex for the string you say you want to find.

<your search> | rex "(?<cmd>program\.exe -switch property)" | table cmd

If your needs are more complex than this then please edit your question to add more detail.

[gcusello]

Hi nnaik,
the regex command is to search for a regex, if you want to extract a field from a log you have to use the rex command.
If you could share a sample of your data I could be more detailed, but you should try something like this (you can test it on regex101):

your_search
| rex "^(?<cmd>\s\w\D*\.\D*\s\D*\d)" 
| table cmd

Bye.
Giuseppe

[nnaik]

Thank you Giuseppe for getting back but this does not work.

Essentially, eventlogs come with lots of data and I could create table from that data but it is not really clean. I want to be able to grep exactly what I want per alert. So in this case, for example, I want to grep only 'program.exe -switch property', that way I know who is running what. The Regex I have will grab this but just dont know how to get this in splunk.

So I tried your command but it does not grab or create table with just 'program.exe -switch property'. It shows nothing for field cmd.

Any help is appreciated.

[adonio]

can you share data sample please?