Splunk Search

How to extract value from a field?

thebankitgui
Path Finder

Good Afternoon!

I have a search (code example #1) that looks for the EventData_Xml field looking at programs installed. I'm creating a report to show what where and when. Trying to cut out the unneeded data and show just the program name, such as Microsoft Edge in the "Program Installed" column in the code example #2 below.

Thank you in advance for any assistance. I appreciate it.

 

index=wineventlog EventData_Xml="*" AND EventID=11707
| table host _time EventData_Xml
| rename host as "Host", _time as "Time", EventData_Xml as "Program Installed"
| convert ctime(Time)
<Data>Product: Microsoft Edge -- Installation completed successfully.</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data>(NULL)</Data><Data></Data><Binary>7B34443639394544332D333539302D334635352D424638302D3732374546444242313032467D</Binary>

 

 

Labels (4)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The rex command can do that.

 

index=wineventlog EventData_Xml="*" AND EventID=11707
| rex field=EventData_Xml "Product: (?<Product>[^-]+)"
| table host _time Product
| rename host as "Host", _time as "Time", Product as "Program Installed"
| convert ctime(Time)

 

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The rex command can do that.

 

index=wineventlog EventData_Xml="*" AND EventID=11707
| rex field=EventData_Xml "Product: (?<Product>[^-]+)"
| table host _time Product
| rename host as "Host", _time as "Time", Product as "Program Installed"
| convert ctime(Time)

 

 

---
If this reply helps you, Karma would be appreciated.

thebankitgui
Path Finder

This is what I get with that string. This is the problem row. Thank you for your help.

The results of this query.The results of this query.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There was a typo in my answer.  I've fixed it.

---
If this reply helps you, Karma would be appreciated.

thebankitgui
Path Finder

Any thoughts on sorting by time descending? I've tried a few different ways and it only sorts by the month at the beginning with 1 on top or 12 on top but not accurate to the whole date.

I've tried | sort _time desc and asc and few other variations. Thank you.

 

Edit: Disregard, one well placed "| sort - _time" before the table sorted by desc.

 

thebankitgui
Path Finder

Thank you very much! Looks nice and clean now. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...