All Apps and Add-ons

McAfee ePO Logs question

MFiller90
New Member

I am ingesting McAfee ePO logs from several endpoints.

We have an eval command that works pretty well by coalescing all the file paths into this 1 eval command.

EVAL-file_path = coalesce(file_path1,filepath2,filepath_3)

Each of these file paths end up looking something like:
\Path\to\file\filename.exe
\Path\to\file\filename.log

I wanted to try and extract that "filename.exe" by itself and give it its own field.

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee
rex field=file_path "(?<filename>[^\\]*)$"

That should extract the last segment (i.e., the filename) from the file path

0 Karma

MFiller90
New Member

We're trying to make this a field via a search time extraction. If I could somehow grab that rex command and throw it into an eval, that would be great, but looking over the EVAL documentation, it doesnt look like thats supported.

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

You dont need to put it into an eval. If you use | rex ... |, the filename is a field that is created

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...