I am trying to parse dir command txt files that are formatted as follows:
Directory of C:\Windows\addins 09/15/2018 02:33 AM <DIR> . 09/15/2018 02:33 AM <DIR> .. 09/15/2018 02:29 AM 802 FXSEXT.ecf 1 File(s) 802 bytes Directory of C:\Windows\ADFS 04/30/2021 09:27 AM <DIR> . 04/30/2021 09:27 AM <DIR> .. 04/30/2021 09:27 AM <DIR> en 04/30/2021 09:24 AM 40,960 Microsoft.IdentityServer.Deployment.Core.dll 1 File(s) 40,960 bytes Directory of C:\Windows\ADFS\en 04/30/2021 09:27 AM <DIR> . 04/30/2021 09:27 AM <DIR> .. 04/30/2021 09:25 AM 6,144 Microsoft.IdentityServer.Deployment.Core.Resources.dll 1 File(s) 6,144 bytes Directory of C:\Windows\appcompat 09/15/2018 02:33 AM <DIR> . 09/15/2018 02:33 AM <DIR> .. 09/15/2018 02:33 AM <DIR> appraiser 09/15/2018 02:33 AM <DIR> Programs 02/28/2021 08:08 PM <DIR> UA 0 File(s) 0 bytes
What I am trying to do is parse this unstructured dynamic data and append the filenames to the directory it falls under and put the output in their own event. For example the first directory above is C:\Windows\addins but i want to add the FXSEXT.ecf file to it and any other file that may exist (other than the output ) and append the directory to it and create its own event so this would turn into an event like this:
along with the creation time for that file only and the file size.
the filenames can be none to a plethora and but only trying to get the files and not directorys under as the dir command walks the entire filesystem so eventually the directory is in the output somewhere later in the data.
I have tried the multiline codec and I have tried to grok the data which worked but doesnt not help me append the filepath as it has been written already to a prior event. Im not sure where to go on this and would appreciate any help. Thank you in advance for any help.