Splunk Search

Extract fields from an already extracted field

markwymer
Path Finder

Hi all,

I'm trying to extract the filename and file ext of a windows path into to different fields. The sourcetype is CSV and the path is already extracted into a field called Threat Target File Path.

The event looks like:

10/30/15 8:01:40 AM,Z4437-E6A5-58E3,10.221.7.210,C:\Users\u106420\Videos\WP_20140610_002.mp4,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe

The field Threat Target File Path contains:

C:\Users\u106420\Videos\WP_20140610_002.mp4

And I would like:

Threat Target File Name = WP_20140610_002
Threat Target File Ext = mp4

I would like 'automate' this so I'm guessing that i need to add entries into the transforms.conf and props.conf,

Is this possible and what entries would I need to get the two additional field extractions?

Many thanks for any help,
Mark.

0 Karma

woodcock
Esteemed Legend

Try this:

Inside props.conf:

REPORT-this_part_does_not_matter_but_must_come_below_whatever_created_Threat_Target_File_Path = filename_into_two_parts

Inside transforms.conf:

[filename_into_two_parts]
SOURCE_KEY="Threat Target File Path"
REGEX=[^\.]+?(?<ThreatTargetFileName>[^\\\.]+)(?:\.(?<ThreatTargetFileExt>[^\\\.]*))?$
0 Karma

markwymer
Path Finder

Aaaargggg - all the "backslashes" have been removed 😞

0 Karma

ppablo
Community Manager
Community Manager

Hi @markwymer

Make sure to use the text editor tools in the "ask a question" UI to render special characters properly. @woodcock (thanks!) already edited your post for you, but in the future, whenever you're sharing sample code, data, search strings, conf file stanzas (especially anything with regex), etc., highlight it and click the Code Sample button. This will wrap it in a code box so it appears as it should. If you're sharing a snippet of code or regex within a sentence, you can enclose it between two back-ticks () so it appears like this!@#$%^&*%^$\*|\`

0 Karma

markwymer
Path Finder

sorry just noticed a typo. The '\' have been removed from the Path name. It should be

10/30/15 8:01:40 AM,Z4437-E6A5-58E3,10.221.7.210,C:\Users\u112200\Videos\WP_20140610_002.mp4,NT AUTHORITY\SYSTEM,C:\Windows\system32\svchost.exe

and the "Threat Target File Path" is

C:\Users\u112200\Videos\WP_20140610_002.mp4

Hopefully, this will now look better

0 Karma

markwymer
Path Finder

Nope - all the '\'s get removed!

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...