Splunk Search

Rex for drive letters

nashia
New Member

I only want to look at built in shares like A$-Z$, but not ADMIN$ or IPC$. Is there a rex expression that will allow me to do this?

rex field=share_name "(?[a-zA-Z]{1}+)\$+" works similarly, where I get A$, C$, D$, G$, etc; but it will also give me C$ from the end of IPC$ and N$ from the end of ADMIN$.

I guess what I need is to first only rex if there are two characters (letter + $)... Any help is appreciated.

Tags (2)
0 Karma

FrankVl
Ultra Champion

What is in the share_name field? Just the short name, or a full url like \servername\c$?

0 Karma

harsmarvania57
Ultra Champion

Hi,

Please try below regex

| rex field=share_name "^(?<drive>[a-zA-Z]\$)"
0 Karma

nashia
New Member

Hi, Thank you for your answer; unfortunately it does not work.

0 Karma

FrankVl
Ultra Champion

Can you be a bit more specific than "it does not work"?

0 Karma

FrankVl
Ultra Champion

Second z should be Z I guess? 😉

But yes, that should do the trick. If the share_name contains a full UNC path, try "\\(?<drive>[a-zA-Z]\$)"

harsmarvania57
Ultra Champion

Thanks for pointing this. 🙂

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...