Splunk Search

Using Rex to pull out a file path , file name and extension from verbose message field

ViperV
Explorer

Hi all,

 

I'm new to splunk searches and would appreciate some help to find out how to pull out the file path, file name and file extension from the message field(example below)

The message has verbose text and the path occurs twice within the text. In this example I'd be looking to extract from within the text the file path, file name and file extension and present them in a four column table along with the the time of the event. 

 

Thanks in advance!

 
 
Message=Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\SplunkUniversalForwarder\bin\splunkd.exe) attempted to load \Device\HarddiskVolume1\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe that did not meet the Enterprise signing level requirements or violated code integrity policy (Policy ID:{a244370e-44c9-4c06-b551-f6016e563076}). However, due to code integrity auditing policy, the image was allowed to load.
 
Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ViperV,

you have to use a different regex for a di fferent log:

| rex "\((?<path>\\.+)\\(?<file>[^\.]+)\.(?<ext>[^\)]+)\)"

that you can test at https://regex101.com/r/ZJ0Fyv/1

or the second:

| rex "\s(?<path>\\.+)\\(?<file>.+)\.(?<ext>[^\)]+)"

that you can test at https://regex101.com/r/ZJ0Fyv/1

If this answer solves your need, please accept it for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

View solution in original post

ViperV
Explorer

Great, thanks!

 

Would that also work for the following type of path?

(\Device\HarddiskVolume1\Windows\explorer.exe) attempted to load \Device\HarddiskVolume1\Users\vagrant\Downloads\kitty-0.74.4.6.exe 
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ViperV,

you have to use a different regex for a di fferent log:

| rex "\((?<path>\\.+)\\(?<file>[^\.]+)\.(?<ext>[^\)]+)\)"

that you can test at https://regex101.com/r/ZJ0Fyv/1

or the second:

| rex "\s(?<path>\\.+)\\(?<file>.+)\.(?<ext>[^\)]+)"

that you can test at https://regex101.com/r/ZJ0Fyv/1

If this answer solves your need, please accept it for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

ViperV
Explorer

Works a charm! thanks!

0 Karma

ViperV
Explorer

Grazie Giuseppe!

 

I got the following error on trying the code

Error in 'rex' command: Encountered the following error while compiling the regex '\s(?<path>\.*\bin\)(?<file>[^\.]+)\.(?<ext>\w+)\s': Regex: missing closing parenthesis.

should i be closing it with an extra parenthesis?

 

i guess to create a table i do the following?

...|table path, file, ext

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ViperV,

beware: that are two backslashes three times in the first part of the regex, not one:

| rex "\s(?<path>\\.*\\bin\\)(?<file>[^\.]+)\.(?<ext>\w+)\s"

because you have backslash in your path but backslash is a special char in regexes that must be escaped with another backslash.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @ViperV,

I didn't undestand if you need to extract the first path or the second.

Anyway, the first extraction is:

| rex "\((?<path>\\.*\\bin\\)(?<file>[^\.]+)\.(?<ext>\w+)\)"

that you can test at https://regex101.com/r/DN7taY/1

the second one is:

| rex "\s(?<path>\\.*\\bin\\)(?<file>[^\.]+)\.(?<ext>\w+)\s"

that you can test at \s(?<path>\\.*\\bin\\)(?<file>[^\.]+)\.(?<ext>\w+)\s

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...