Splunk Dev

Regex file name after space

jacqu3sy
Path Finder

Hi,

Regex wimp here...

I need to extract the file name after the word detected fro ma _raw event.

Example of _raw log;

change to a file has been detected /etc/fileinquestion.conf

I've tried the following but it errors;

| rex field=_raw "detected\s*(?*)"

Any helps appreciated. Thanks.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

Hi can you try:

    | rex field=_raw "detected\s*(?P<filename>.*)"

View solution in original post

tiagofbmm
Influencer

Considering that your message might vary the part before the file name, i think you should use a negative lookahead style, like this

 | rex field=_raw "(?=\/)(?P<filename>.*)"

jacqu3sy
Path Finder

It works, but I'm not sure how!? Would you mind explaining what the (?=\/) achieves?

0 Karma

tiagofbmm
Influencer

It says to the regex processor to not capture anything until it finds the /.

It is more agile than assuming the logs always have the word "detected". But it's up to your specific scenario though.

If it suits you, please upvote the answer as it is a valid option

0 Karma

jacqu3sy
Path Finder

Great. Thanks.

0 Karma

p_gurav
Champion

Hi can you try:

    | rex field=_raw "detected\s*(?P<filename>.*)"

jacqu3sy
Path Finder

Worked a treat. Thanks.

0 Karma

p_gurav
Champion

Please accept answer if its helpful.. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...