Splunk Search

Is it possible to search for certain events within raw data?

ecanmaster
Explorer

Would it be possible to search for certain events within the raw data?
For example, I need to find events with C:\Windows\explorer.exe

I used | extract kvdelim=":\t" pairdelim="\n" on the raw events, but its not parsing the field that I wanted,
so I used rex to get the field parsed and this worked, bu then I couldn't do any searches on the field, because I need to adjust fields.conf or something like that, so instead of creating fields, I was wondering if we could straight search for the events with Rex?

Or maybe eval would be better command to create field and search for events within a field?

0 Karma
1 Solution

inventsekar
Super Champion

just you can include the C:\Windows\explorer.exe as a search string with "\" escaped -
index=main base-search "C:\\Windows\\explorer"

if regex is needed,
base-search | regex _raw="C:\\\Windows\\\explorer\.exe
alt text

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

View solution in original post

0 Karma

inventsekar
Super Champion

just you can include the C:\Windows\explorer.exe as a search string with "\" escaped -
index=main base-search "C:\\Windows\\explorer"

if regex is needed,
base-search | regex _raw="C:\\\Windows\\\explorer\.exe
alt text

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

ecanmaster
Explorer

thx iventsekar,

index=main base-search "C:\\Windows\\explorer"

this was good enough, I didn't know about the \ , that was probably the reason I couldn't get any results, but it works now, thank you

0 Karma

inventsekar
Super Champion

you want to list down the events which contains the string "C:\Windows\explorer.exe" or you want to extract this or similar paths from the events.. please clarify.. maybe post some sample events.

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

ecanmaster
Explorer

just events containing this string in the raw data: "C:\Windows\explorer.exe"

0 Karma

inventsekar
Super Champion

just you can include the C:\Windows\explorer.exe as a search string with "\" escaped -
index=main base-search "C:\\Windows\\explorer"

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

inventsekar
Super Champion

@ecanmaster, if the answer looks good, can you please accept the answer, thanks.

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...