Splunk Search

Regex Source and Destination files with path, filename, extension

kent_farries
Path Finder

I need some help with this one since it is beyond my regex skills which are not the best. I would have used the field extractor but the data does not show up to extract. The data comes from a tool called Varonis DatAlert and is stored in the Windows Event log and we want to be able to use this for custom Ransomware alerting.

The field from the Windows Event log called Additional_Data and I would like to extract it into 6 fields.

Additional_Data Sample
I:\Dept3\folder1\folder two\folder 3\folder 4\Filename1.htm changed to I:\Dept3\folder1\folder two\folder 3\folder 4\Filename1.txt

Desired Fields
source_path = I:\Dept3\folder1\folder two\folder 3\folder 4
source_file = Filename1.htm
source_type = htm
dest_path = I:\Dept3\folder1\folder two\folder 3\folder 4
dest_file = Filename1.txt
dest_type = txt

Thanks in advance

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

It should be something like this if I'm not mistaken:

| rex field=Additional_Data  "^(?<source_path>.+?)\\\(?<source_file>[^\\\]+) changed to (?<dest_path>.+?)\\\(?<dest_file>[^\\\]+)$"
| rex field=source_file "\.(?<source_type>[^\.]+)$"
| rex field=dest_file "\.(?<dest_type>[^\.]+)$"

This is the way I tested it in my lab:

| stats count | fields - count
| eval Additional_Data ="I:\\Dept3\\folder1\\folder two\\folder 3\\folder 4\\Filename1.htm changed to I:\\Dept3\\folder1\\folder two\\folder 3\\folder 4\\Filename1.txt"
| rex field=Additional_Data  "^(?<source_path>.+?)\\\(?<source_file>[^\\\]+) changed to (?<dest_path>.+?)\\\(?<dest_file>[^\\\]+)$"
| rex field=source_file "\.(?<source_type>[^\.]+)$"
| rex field=dest_file "\.(?<dest_type>[^\.]+)$"

Output (see picture below):

alt text

View solution in original post

0 Karma

kent_farries
Path Finder

Thank you so much for all the answers you guys are awesome.

I have one of them working right now and have tested a couple of the others but was not able to get them fully working yet. I will go through all of them after work.

I do like the props and transforms as well but based on two of my tests it did not work yet and I'm probably doing something wrong. I used them in my app on the search head but the fields did not show up and I have not tried to troubleshoot it yet.

Once again, thanks!!!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Since you want to extract this field from an existing field (Additional_Data), you'd have to to use Field Transforms.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Createandmaintainsearch-timefieldextract...

May something like this would work

props.conf (on Search Head)

[yourWinEventLogsourcetype]
REPORT-fromadditionaldata = additional_data_fields

transforms.conf (on Search Head)

[additional_data_fields]
SOURCE_KEY = Additional_Data
REGEX = (?<source_path>.+\\\(?<source_file>[^\.]+)\.(?<source_type>\S+)) changed to (?<dest_path>.+\\\(?<dest_file>[^\.]+)\.(?<dest_type>\S+)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This works with your sample data.

... | rex field=Additional_Data "(?<source_path>.*?)\\(?<source_file>[^ ]+\.(?<source_type>\w+)) changed to (?<dest_path>.*)\\(?<dest_file>.+?\.(?<dest_type>\w+))$" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

gokadroid
Motivator

can you try below:

yourBaseQuery
| rex field=Additional_Data "(?<source_path>.*\\)(?<sFileName>[^\.]+)\.(?<source_type>[^\s]+)\schanged\sto\s(?<dest_path>.*\\)(?<dFileName>[^\.]+)\.(?<dest_type>[^\s]+)"
| eval source_file=sFileName.".".source_type
|eval dest_file=dFileName.".".dest_type
| table Additional_Data, source_path, source_file, source_type, dest_path, dest_file, dest_type
0 Karma

javiergn
SplunkTrust
SplunkTrust

It should be something like this if I'm not mistaken:

| rex field=Additional_Data  "^(?<source_path>.+?)\\\(?<source_file>[^\\\]+) changed to (?<dest_path>.+?)\\\(?<dest_file>[^\\\]+)$"
| rex field=source_file "\.(?<source_type>[^\.]+)$"
| rex field=dest_file "\.(?<dest_type>[^\.]+)$"

This is the way I tested it in my lab:

| stats count | fields - count
| eval Additional_Data ="I:\\Dept3\\folder1\\folder two\\folder 3\\folder 4\\Filename1.htm changed to I:\\Dept3\\folder1\\folder two\\folder 3\\folder 4\\Filename1.txt"
| rex field=Additional_Data  "^(?<source_path>.+?)\\\(?<source_file>[^\\\]+) changed to (?<dest_path>.+?)\\\(?<dest_file>[^\\\]+)$"
| rex field=source_file "\.(?<source_type>[^\.]+)$"
| rex field=dest_file "\.(?<dest_type>[^\.]+)$"

Output (see picture below):

alt text

0 Karma

kent_farries
Path Finder

Thanks worked first try.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...