Building for the Splunk Platform

Regex file name after space

jacqu3sy
Path Finder

Hi,

Regex wimp here...

I need to extract the file name after the word detected fro ma _raw event.

Example of _raw log;

change to a file has been detected /etc/fileinquestion.conf

I've tried the following but it errors;

| rex field=_raw "detected\s*(?*)"

Any helps appreciated. Thanks.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

Hi can you try:

    | rex field=_raw "detected\s*(?P<filename>.*)"

View solution in original post

tiagofbmm
Influencer

Considering that your message might vary the part before the file name, i think you should use a negative lookahead style, like this

 | rex field=_raw "(?=\/)(?P<filename>.*)"

jacqu3sy
Path Finder

It works, but I'm not sure how!? Would you mind explaining what the (?=\/) achieves?

0 Karma

tiagofbmm
Influencer

It says to the regex processor to not capture anything until it finds the /.

It is more agile than assuming the logs always have the word "detected". But it's up to your specific scenario though.

If it suits you, please upvote the answer as it is a valid option

0 Karma

jacqu3sy
Path Finder

Great. Thanks.

0 Karma

p_gurav
Champion

Hi can you try:

    | rex field=_raw "detected\s*(?P<filename>.*)"

jacqu3sy
Path Finder

Worked a treat. Thanks.

0 Karma

p_gurav
Champion

Please accept answer if its helpful.. 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...