Splunk Search

Why does this field extraction and rex give different results?

tfilip
Engager

I'm completely stuck here. I'm trying to extract the "Path" from a logfile with this format:

 

 

Time:	 05/10/2022 11:26:53
Event:  Traffic
IP Address:  xxxxxxxxxx
Description:  HOST PROCESS FOR WINDOWS SERVICES
Path:  C:\Windows\System32\svchost.exe
Message:      Blocked Incoming UDP  -  Source  xxxxxxxxxx :  (xxxx)   Destination  xxxxxxxxxx :  (xxxxx)
Matched Rule:  Block all traffic

 

 

using this regex

 

 

((Path:\s{1,2})(?<fwpath>.+))

 

 

It does exactly what I want when I use rex, it extracts the path as "fwpath". However, when I do it as a field extraction, it matches the rest of the log entry. Why is it behaving differently for these two?

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

((Path:\s{1,2})(?<fwpath>\S+))

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this

((Path:\s{1,2})(?<fwpath>\S+))

tfilip
Engager

That (almost) did it! I had to replace \S with \N so that it wouldn't stop at spaces in paths, like "C:\Program Files".

 

Thanks much!

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...