:rainbowCrow: on Nostr: This is admittedly ugly but if you are in a situation like me where you don't have ...

This is admittedly ugly but if you are in a situation like me where you don't have visibility beyond Splunk and want to see what VS Code extensions are in your environment, this is working well for me today:index=wineventlog_security sourcetype=XmlWinEventLog EventCode=4688 code extensions<br>| stats count BY host, Process_Command_Line<br>| rex field=Process_Command_Line "\\\extensions\\\(?&lt;extension&gt;[^\\\\ \"]+)"<br>| stats values(extension) AS extensions BY host, user<br>| rename host AS "Host", user AS "User", extensions AS "VS Code Extensions"



Obviously you'll need to change the index, etc. to match your environment.