How do you get the following search to return a piece of the process status rather than the whole output of the command line?

[bsaujla131984]

I have set up a query to check the status of linux/unix processes for a number of processes. However, when it displays the results, it shows the whole output of the command line instead of showing the status of process.

For example, the search is to check the output of process ABCDEF. But when I run the query, it shows as below:-

://java/path/abc: ABCDEF:/export/path/...
Is there a way I can extract just the process name instead of the whole command line as output?

regex

Thanks,

[kmorris_splunk]

Try this:

... | rex field=_raw ": (?<process>\w+):"

https://regex101.com/r/dT228W/3

[ddrillic]

For extra measure of safety - :\s+(?<process>\w+): ; -)