Splunk Search

Using Rex to pull out a file path , file name and extension from verbose message field

ViperV
Explorer

Hi all,

 

I'm new to splunk searches and would appreciate some help to find out how to pull out the file path, file name and file extension from the message field(example below)

The message has verbose text and the path occurs twice within the text. In this example I'd be looking to extract from within the text the file path, file name and file extension and present them in a four column table along with the the time of the event. 

 

Thanks in advance!

 
 
Message=Code Integrity determined that a process (\Device\HarddiskVolume1\Program Files\SplunkUniversalForwarder\bin\splunkd.exe) attempted to load \Device\HarddiskVolume1\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe that did not meet the Enterprise signing level requirements or violated code integrity policy (Policy ID:{a244370e-44c9-4c06-b551-f6016e563076}). However, due to code integrity auditing policy, the image was allowed to load.
 
Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ViperV,

you have to use a different regex for a di fferent log:

| rex "\((?<path>\\.+)\\(?<file>[^\.]+)\.(?<ext>[^\)]+)\)"

that you can test at https://regex101.com/r/ZJ0Fyv/1

or the second:

| rex "\s(?<path>\\.+)\\(?<file>.+)\.(?<ext>[^\)]+)"

that you can test at https://regex101.com/r/ZJ0Fyv/1

If this answer solves your need, please accept it for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

View solution in original post

ViperV
Explorer

Great, thanks!

 

Would that also work for the following type of path?

(\Device\HarddiskVolume1\Windows\explorer.exe) attempted to load \Device\HarddiskVolume1\Users\vagrant\Downloads\kitty-0.74.4.6.exe 
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ViperV,

you have to use a different regex for a di fferent log:

| rex "\((?<path>\\.+)\\(?<file>[^\.]+)\.(?<ext>[^\)]+)\)"

that you can test at https://regex101.com/r/ZJ0Fyv/1

or the second:

| rex "\s(?<path>\\.+)\\(?<file>.+)\.(?<ext>[^\)]+)"

that you can test at https://regex101.com/r/ZJ0Fyv/1

If this answer solves your need, please accept it for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

ViperV
Explorer

Works a charm! thanks!

0 Karma

ViperV
Explorer

Grazie Giuseppe!

 

I got the following error on trying the code

Error in 'rex' command: Encountered the following error while compiling the regex '\s(?<path>\.*\bin\)(?<file>[^\.]+)\.(?<ext>\w+)\s': Regex: missing closing parenthesis.

should i be closing it with an extra parenthesis?

 

i guess to create a table i do the following?

...|table path, file, ext

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ViperV,

beware: that are two backslashes three times in the first part of the regex, not one:

| rex "\s(?<path>\\.*\\bin\\)(?<file>[^\.]+)\.(?<ext>\w+)\s"

because you have backslash in your path but backslash is a special char in regexes that must be escaped with another backslash.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @ViperV,

I didn't undestand if you need to extract the first path or the second.

Anyway, the first extraction is:

| rex "\((?<path>\\.*\\bin\\)(?<file>[^\.]+)\.(?<ext>\w+)\)"

that you can test at https://regex101.com/r/DN7taY/1

the second one is:

| rex "\s(?<path>\\.*\\bin\\)(?<file>[^\.]+)\.(?<ext>\w+)\s"

that you can test at \s(?<path>\\.*\\bin\\)(?<file>[^\.]+)\.(?<ext>\w+)\s

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...