About nnaik

nnaik · ‎10-02-2019

Thank you all! Rich Galloway, Your solution works. Thank you! Essentially, I wanted to extract just specific data from logs and create table of this extracted data only so that my reports are clean looking. Only change I made is put \w in beginning of each word so if someone typed caps or lowercase, it would be captured. | rex "(?\wrogram.exe -\wwitch \wroperty)" | table cmd Thanks again!

nnaik · ‎09-28-2019

Thank you Giuseppe for getting back but this does not work. Essentially, eventlogs come with lots of data and I could create table from that data but it is not really clean. I want to be able to grep exactly what I want per alert. So in this case, for example, I want to grep only 'program.exe -switch property', that way I know who is running what. The Regex I have will grab this but just dont know how to get this in splunk. So I tried your command but it does not grab or create table with just 'program.exe -switch property'. It shows nothing for field cmd. Any help is appreciated.

nnaik · ‎09-26-2019

Hey guys, I have a log that contains a lot of data but from that, I want to extract 'program.exe -switch' from the log and create a new field that I can display with table command. I have regex ready and confirmed on regex101.com. But I tried some of the below in my search and no luck. I've looked up rex command and examples on answers.splunk.com as well. But not sure how I can use rex command in this case. ....regex cmd="/^(\s\w\D*.\D*\s\D*\d)$/" | table cmd ....regex cmd="\s\w\D*.\D*\s\D*\d" | table cmd ....regex cmd="\s\w\D*.\D*\s\D*\d" | table cmd Any ideas how I can get this data?

Posts	3
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎09-26-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to extract 'program.exe -switch' from the log ...

Re: How to extract 'program.exe -switch' from the ...

Re: How to extract 'program.exe -switch' from the ...

How to extract 'program.exe -switch' from the log ...