How to extract all sub strings ends with .csv in a string?

SumitPan — Sun, 06 Nov 2016 22:36:39 GMT

Sorry I'm new to regex. I'm trying to get some meaning full data from the log files.

I want all the sub-strings ending with .csv in my log file at any given point of time. Below is the the log file preview. Any leads would be highly appreciated.

Re: How to extract all sub strings ends with .csv in a string?

Richfez — Mon, 07 Nov 2016 01:19:07 GMT

Try..

 ... | rex "(?<MyCSVFile>\w+\.csv)"

Change the name MyCSVFile to whatever you want to call it. Here you can see it in regex101.com.

Re: How to extract all sub strings ends with .csv in a string?

lakromani — Mon, 07 Nov 2016 06:51:08 GMT

It's better if you past the text in stead of a picture of the text.

Re: How to extract all sub strings ends with .csv in a string?

SumitPan — Tue, 29 Sep 2020 11:42:19 GMT

Below are the logs. Need to list down all files names ending with .csv. e.g.:
1. adn_attribute_set.csv
2. adn_navigation_attributes.csv

host=mdc1vr1002 sourcetype=MCOM_ETL_OUT

Re: How to extract all sub strings ends with .csv in a string?

SumitPan — Fri, 11 Nov 2016 17:13:43 GMT

it fixed the problem.......

rex field=_raw ".*\s(?P.*\.csv)$" |search CSVFiles=*

Re: How to extract all sub strings ends with .csv in a string?

lakromani — Fri, 11 Nov 2016 21:37:26 GMT

Then this should do:
your search | rex "(?<file>\w+\.csv)"

Sames as rich7177 posted. So if this works, accept his answer.

PS some lines have more than one file name, this rex gets them all.

2016-11-06 19:42:36,977 | DEBUG | main:ConcatNCopy | Copy: attr_prod_brand_ship.csv attr_prod_copy_reg.csv attr_prod_data_source.csv attr_prod_forced_new.csv attr_prod_site_search.csv attr_prod_trigger_data.csv attr_prod_tuple_data.csv to

Re: How to extract all sub strings ends with .csv in a string?

lakromani — Sat, 12 Nov 2016 22:19:43 GMT

This rex does not work with the above data.
It can not be complete here?

PS you do not need to specify field=_raw, if omitted, _raw is used by default.

Re: How to extract all sub strings ends with .csv in a string?

SumitPan — Sat, 12 Nov 2016 23:14:43 GMT

I have tried both the rex and both seems to be working fine.

Re: How to extract all sub strings ends with .csv in a string?

lakromani — Sun, 13 Nov 2016 08:02:21 GMT

(?P..csv) this does not extract anything. If it was more like (?<CSVFiles>\w+\.csv) it will work.

topic How to extract all sub strings ends with .csv in a string? in Security

How to extract all sub strings ends with .csv in a string?

Re: How to extract all sub strings ends with .csv in a string?

Re: How to extract all sub strings ends with .csv in a string?

Re: How to extract all sub strings ends with .csv in a string?

Re: How to extract all sub strings ends with .csv in a string?

Re: How to extract all sub strings ends with .csv in a string?

Re: How to extract all sub strings ends with .csv in a string?

Re: How to extract all sub strings ends with .csv in a string?

Re: How to extract all sub strings ends with .csv in a string?