Splunk Search

Extract multiple file names from email attachments

biers04
Explorer

Trying to extract all email attachments file names. I am no good with Rex/Regex, so I used the automatic extraction in Splunk... However, the extraction is only pulling the first file name, never anything after.

In Splunk on the Extraction/Transfor, field I got
(?=[^"](?:"filename":|"."filename":))^[^/\n]*/\w+",\s+"\w+":\s+"(?P[^"]+)

Need to know what to add in order for it to loop through for each attachment.

0 Karma

biers04
Explorer

Sorry all, completely forgot about it. Still an issue, but I don't have time to deal with it at this point. If I can delete the question, I will.

0 Karma

MousumiChowdhur
Contributor

Hi,
Can you please share sample logs? Also, if your rex is working fine then can you try adding max_match = 0 after the rex which will help you in looping through each attachment.

0 Karma

Sukisen1981
Champion

Hi,

You need to provide us a sample of your logs. One suggestion - your regex is probably not working. You need to write your own regex and not depend on extract from splunk web, If you do provide us a some samples we can surely help you on this

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Please share some sample log entries. You probably need to user Field transform in order to capture multiple values (creating multivalued field).

DalJeanis
SplunkTrust
SplunkTrust

@biers04 - is this still an issue? If so, please post some non-confidential samples of the events you are trying to extract. When you post the data, or when you post code, please be sure to mark it with the code button (101 010) or surround it with grave accents (the ones on the tilde key ~), or put at least four spaces before each line, so that the interface will not treat html-like data as html or xml code.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...