Regular Expression to Extract Values From a Field

[Bytes]

Hello Ninjas,

Am having some trouble trying to figure out how to use regex to perform a simple action.

So I have a field called Caller_Process_Name which has the value of C:\Windows\System32\explorer.exe

I want to take the "explorer.exe" part out of this field and place it in a new field (called process_name_short). So I see regex as the solution here.

I have been trying the following but I do not believe I am using regex correctly in Splunk and the documentation isn't very helpful.

| rex field=Caller_Process_Name (?<process_name_short>/(\w+)\.(\w+)$/)

I'm sure my regex is solid as it pulls out only the explorer.exe part of the string in the online regex testers.

Would anyone be willing to show me what I'm not doing right here please.

Thanks 🙂

[Bytes]

Apologies. There should be back slashes instead of forward slashes in the UNC path. Had to use forward slashes on the question as it wouldn't allow back slashes.

[richgalloway]

Backslashes are allowed if you put the string within backtics. I've edited your question to use the right slashes.

[Bytes]

Thank you! 🙂

[javiergn]

See my answer below. I did answer both cases

[ArthurGautesen]

Two questions off the top.
Is it "C:/Windows/System32/explorer.exe" or "C:\Windows\System32\explorer.exe" ?

And are you enclosing your regular expression in quotes?

[Bytes]

It should be back slashes as it is a normal Windows path. I added forward slashes as it wouldn't allow back slashes (as your answer shows 🙂 )

I wasn't using quotes but even if I do, it still fails to extract the value and place it in a new field named process_name_short.

[richgalloway]

Quotes are required. The extraction failed because the regex is incorrect.

[jmallorquin · Accepted solution]

Hi you can use this.

 | rex field=Caller_Process_Name "(?<process_name_short>[^\\]+$)"

Hope i help you

[Bytes]

Needed three slashes as the second was cancelling out the end square bracket.

But IT WORKED!

Here's the full command that worked:

| rex field=Caller_Process_Name "(?<process_name_short>[^\\\]+$)"

This pulls out the program name part of the path and places it in a new field called process_name_short which I was able to run a stats command on to count up the different programs throwing audit fails.

Thanks everyone!

[javiergn]

Try this:

| rex field=Caller_Process_Name "\/(?<process_name_short>[^\/]+$)"

[javiergn]

And the equivalent for Windows paths:

| rex field=Caller_Process_Name "\\\(?<process_name_short>[^\\\]+$)"

[Bytes]

Nope neither worked. Got the error returned:

Error in 'rex' command: Encountered the following error while compiling the regex '\

[jmallorquin]

this regex doesn't capture nothing... use mine 🙂

[javiergn]

That's because I made a typo sorry:

 | rex field=Caller_Process_Name "\\\(?<process_name_short>[^\\\]+$)"

[javiergn]

[dcharboneau_spl]

You should only have two (not three) backslashes at the beginning of the REX and in side the Brackets after the ^.

[javiergn]

It throws an error with two, I had to use three. See the picture above.
This works:

| stats count
| eval Caller_Process_Name = "C:\Windows\System32\explorer.exe"
| rex field=Caller_Process_Name "\\\(?<process_name_short>[^\\\]+$)"

This doesn't:

| stats count
| eval Caller_Process_Name = "C:\Windows\System32\explorer.exe"
| rex field=Caller_Process_Name "\\(?<process_name_short>[^\\]+$)"

Anyway, let's focus on the actual problem and not mine's 🙂

[richgalloway]

Your regular expression doesn't match the example value. Working on regex101.com, I came up with this rex command.

... | rex field=Caller_Process_Name "\\(?<process_name_short>\w+\.\w+)$" | ...