Splunk Search

How can I extract these file names that are in the same event?

daniel333
Builder

Hi all,

I have a file that looks like this -

Added files:
added: /etc/addedthisfile
added: /etc/cron.daily/tripwire-check
added: /etc/tripwire

How can field extract added=*?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

In search you can do like this (in-line field extraction: extracting field 'Files' as multivalued field which contains all paths)

your base search | rex max_match=0 "added: (?<Files>\S+)"

To do that automatically (saved field extraction), you can follow this

https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/ConfigureSplunktoparsemulti-valuefields
OR
https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Exampleconfigurationsusingfieldtransfor...

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

In search you can do like this (in-line field extraction: extracting field 'Files' as multivalued field which contains all paths)

your base search | rex max_match=0 "added: (?<Files>\S+)"

To do that automatically (saved field extraction), you can follow this

https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/ConfigureSplunktoparsemulti-valuefields
OR
https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Exampleconfigurationsusingfieldtransfor...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...