I can test \\[\w]+\\[\w]+\\(?<File_Path>.+) or simply \\\w+\\\w+\\(?<File_Path>.+) in Rex101 and it works fine In Splunk, | rex field=_raw "\[\w]+\[\w]+\(?<File_Path>.+)" I get Regex: unmatched closing parenthesis. What would be the proper way to escape the backslashes in Splunk, I have search for examples but with no definitive answers? Raw data: Application Information: Process ID: 3160 Application Name: \device\harddiskvolume4\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe Network Information: Direction: Outbound I just want the output to be: program files\common files\microsoft shared\clicktorun\officeclicktorun.exe in this example.   ... View more

I am having problems getting the line breaking to work. The below events are showing as one event with the below set in my Props.conf file which is installed on the Indexers. Feb 18 08:11:04 10.10.10.10 sshd[2910906]: Accepted keyboard-interactive/pam for user@domain from 10.10.10.10 port 54258 ssh2 Feb 18 08:11:04 10.10.10.10 sshd[2910906]: pam_unix(sshd:session): session opened for user user@domain by (uid=0) Feb 18 08:11:04 10.10.10.10 sshd[2910906]: Session opened for 'user@domain' on /dev/char/pty/t0 Feb 18 08:11:04 10.10.10.10 shell[2910915]: Interactive shell session started Feb 18 08:11:05 10.10.10.10 vmkernel: cpu39:2098112)NMP: nmp_ResetDeviceLogThrottling:3575: last error status from device mpx.vmhba32:C0:T0:L0 repeated 5 times [VMware:ESXi] TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 15 TZ = CT KV_MODE = none ANNOTATE_PUNCT = false TIME_FORMAT = %b %d %H:%M:%S LINE_BREAKER = ([\n]+)\w{3}\s.\w\s\w{2}:\w{2}:\w{2} SHOULD_LINEMERGE = False TRUNCATE = 750 Any idea why the line breaking is not working? ... View more

This is my search: index="test" sourcetype="Cisco_Users" | rex field=_raw "(?<Host>\w+-\w+-\w+-\w+-?\d?\.\w+\.\w+)\s\((?<IP>\d+\.\d+\.\d+\.\d+)" | eval "IP Address" = IP | rex field=_raw "(Version|version:)\s(?<IOS_Version>\d+.\d+\(\d+\)\w?\w?\w?)" | eval "IOS Version" = IOS_Version | rex field=_raw "(cisco|Hardware:)\s+(?<Model>\w+\s?-?\w+-?\w+)" | rex field=_raw "(Serial Number:\s|Processor [B-B-b-b]oard ID )(?<Serial>\w+)" | eval "Serial Number" = Serial | rex field=_raw "username (?<Username>\w+)" | table Host "IP Address" Model "IOS Version" "Serial Number" Username | Sort 0 Host Sample Event: TV-202-123-RT1.cbs.local (10.30.40.200): Cisco IOS Software, C3750E Software (C3750E-IPBASEK9-M), Version 15.0(2)SE6, RELEASE SOFTWARE (fc2) System image file is "flash:/c3750e-ipbasek9-mz.150-2.SE6/c3750e-ipbasek9-mz.150-2.SE6.bin" cisco WS-C3750X-24 (PowerPC405) processor (revision A0) with 262144K bytes of memory. Processor board ID FDO14 username user1 privilege 15 secret 5 username user2 privilege 15 secret 5 username user3 privilege 15 secret 5 username user4 privilege 15 secret 5 username user5 privilege 15 secret 5 ... View more

I have several events with similar to this raw data field that I would like to break down into a new event for each IP, port, etc: Host: 172.30.x.x () Ports: 22/open/tcp//ssh///, 80/open/tcp//http///, 443/open/tcp//https///, 5000/open/tcp//upnp///, 5564/open/tcp/////, 5570/open/tcp/////, 5678/open/tcp//rrac///, 5988/open/tcp//wbem-http///, 5989/open/tcp//wbem-https///, 8008/open/tcp//http///, 8099/open/tcp//unknown///, 45454/open/tcp///// So in my search (for this example) I want 12 lines that start with this IP address and in the second column have each of the ports listed respectively, followed by the columns port, status, proto, and desc. index = ports_services sourcetype = nonwindows:ports Host Ports | rex field=_raw "(?i)Host:\s(?<dest_ip>\S+)\s+\(\)\s+Ports:\s+(?<port>\d+)\/(?<status>\w+)\/(?<proto>\w+)\/\/(?<desc>\w+)" | table _time dest_ip port status proto desc | sort dest_ip Currently my search works properly for the first port, but does not iterate through to create a new line for each consecutive port. I have read a lot about the makemv delim, but can't seem to make this work. Any ideas? ... View more