"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe" --processStart "Teams.exe" --process-start-args "--system-initiated"
Could someone help me writing regex and rex to extract field(which is a process) name after --processStart .
Next I'll filter out filed name which I don't want match.
Thanks in Advance
Hi
Try this
| makeresults
| eval temp="\"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe\" --processStart \"Teams.exe\" --process-start-args \"--system-initiated\""
| rex field=temp "--processStart\s\"(?P<processname>[^--]+)\""
Try this.
Field extracted using space as delimiter.
| makeresults
| eval input="\"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe\" --processStart \"Teams.exe\" --process-start-args \"--system-initiated\""
| rex field=input "^(?:[^\s]* ){2}\"(?<process>[^ ]+)\""
This too worked for me. Thanks a lot.
Hi
Try this
| makeresults
| eval temp="\"C:\Users\TestUser\AppData\Local\Microsoft\Teams\Update.exe\" --processStart \"Teams.exe\" --process-start-args \"--system-initiated\""
| rex field=temp "--processStart\s\"(?P<processname>[^--]+)\""
This worked. Thanks a lot
If you don't mind can you explain me [^--]+)\"" this part
I mentioned to extract from processStart to before --