Splunk Search

issue querying events in quotes

smudge797
Path Finder

Seeing issue with tabling results inside quotes and wondering if this is know issue with work around?

query:
index=perfmon source=process sourcetype=WinHostMon ProcessId=22864

results:
Type=Process
Name="splunkd.exe"
ProcessId=22864
CommandLine=""C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service"
StartTime="20160817005341.861352+120"
Host="myhost"
Path="C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"

Type=Process
Name="TrustedInstaller.exe"
ProcessId=19228
CommandLine="C:\Windows\servicing\TrustedInstaller.exe"
StartTime="20160816000024.970946+120"
Host="Anotherhost"
Path="C:\Windows\servicing\TrustedInstaller.exe"

query:
index=perfmon source=process sourcetype=WinHostMon ProcessId=22864 | table CommandLine

No results..

0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Yes, the double quotes give little trouble there..

maybe, a quick rex.. tested this and works fine..

sourcetype=WinHostMonTest | rex field=_raw "CommandLine=(?<CmdLine>.+[^\n])" | table CmdLine

alt text

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

Yes, the double quotes give little trouble there..

maybe, a quick rex.. tested this and works fine..

sourcetype=WinHostMonTest | rex field=_raw "CommandLine=(?<CmdLine>.+[^\n])" | table CmdLine

alt text

smudge797
Path Finder

Legend!

Thanks

smudge797
Path Finder

Is there any way to have this data straightened out with a props/transform search time or index time extraction?

0 Karma

smudge797
Path Finder

I cant seem to put this in my dashboard:
...| rex field=_raw "CommandLine=(?.+[^\n])"| table CommandLine

Its complaining about the

    <title>$ProcessID$ Process Drilldown</title>
    <search>
      <query>index=perfmon source=process sourcetype=WinHostMon ProcessId=22864

earliest=$time.earliest$ latest=$time.latest$ host=$Host$ ProcessId=$ProcessID$ | dedup ProcessId | rex field=_raw "CommandLine=(?.+[^\n])"| table Name ProcessId CommandLine Path

true
true
none
none
10

0 Karma

inventsekar
SplunkTrust
SplunkTrust

i am not sure of this one.. let me create a dashboard to check it and update you back..

0 Karma

smudge797
Path Finder

CDATA! sorted it. Thanks

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...