Splunk Search

issue querying events in quotes

smudge797
Path Finder

Seeing issue with tabling results inside quotes and wondering if this is know issue with work around?

query:
index=perfmon source=process sourcetype=WinHostMon ProcessId=22864

results:
Type=Process
Name="splunkd.exe"
ProcessId=22864
CommandLine=""C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service"
StartTime="20160817005341.861352+120"
Host="myhost"
Path="C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"

Type=Process
Name="TrustedInstaller.exe"
ProcessId=19228
CommandLine="C:\Windows\servicing\TrustedInstaller.exe"
StartTime="20160816000024.970946+120"
Host="Anotherhost"
Path="C:\Windows\servicing\TrustedInstaller.exe"

query:
index=perfmon source=process sourcetype=WinHostMon ProcessId=22864 | table CommandLine

No results..

0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Yes, the double quotes give little trouble there..

maybe, a quick rex.. tested this and works fine..

sourcetype=WinHostMonTest | rex field=_raw "CommandLine=(?<CmdLine>.+[^\n])" | table CmdLine

alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

Yes, the double quotes give little trouble there..

maybe, a quick rex.. tested this and works fine..

sourcetype=WinHostMonTest | rex field=_raw "CommandLine=(?<CmdLine>.+[^\n])" | table CmdLine

alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

smudge797
Path Finder

Legend!

Thanks

smudge797
Path Finder

Is there any way to have this data straightened out with a props/transform search time or index time extraction?

0 Karma

smudge797
Path Finder

I cant seem to put this in my dashboard:
...| rex field=_raw "CommandLine=(?.+[^\n])"| table CommandLine

Its complaining about the

    <title>$ProcessID$ Process Drilldown</title>
    <search>
      <query>index=perfmon source=process sourcetype=WinHostMon ProcessId=22864

earliest=$time.earliest$ latest=$time.latest$ host=$Host$ ProcessId=$ProcessID$ | dedup ProcessId | rex field=_raw "CommandLine=(?.+[^\n])"| table Name ProcessId CommandLine Path

true
true
none
none
10

0 Karma

inventsekar
SplunkTrust
SplunkTrust

i am not sure of this one.. let me create a dashboard to check it and update you back..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

smudge797
Path Finder

CDATA! sorted it. Thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...