Splunk Search

Need help in extraction

srinivas_gowda
Path Finder

Hello all,

 

I am tryin to extract only the highlighted from the below event, however I am failing to extract.

Can you please let me know here.

"Error","","/Example/JP1/NTEVENT_LOGTRAP/Oracle.persona","LOGFILE","NTEVENTLOG","LOGFILE","NTEVENTLOG","","","","","",9,"A0","1630500097","A1","PSD067","A2","Application","A3","Error","A4","None","A5","20","A6","N/A"

"Error","","/Example/JP1/NTEVENT_LOGTRAP/Microsoft-Windows-Kerberos-Key-Distribution-Center","LOGFILE","NTEVENTLOG","LOGFILE","NTEVENTLOG"

Thank you

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\/Example(?<resource>[^\"]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\/Example(?<resource>[^\"]+)"

ashvinpandey
Contributor

@srinivas_gowda Use the below command in your search query

 

 

| regex field=_raw "Example(?<resource>.*?)\""

 

 

Also, If this reply helps you, an upvote would be appreciated.

 

0 Karma