topic Re: Regex to capture below format data in Splunk Enterprise

Regex to capture below format data

Ashwini008 — Thu, 04 Mar 2021 15:04:03 GMT

Hi ,

please help me with regex expression to capture the data in below part which is in bold and underlined.

e+o.in_zpiystoc.stkdrtyini.600.1.txt.1.yyyymmddhhmmss
e+o.drlugrbuyhe.xml.1.yyyymmddhhmmss
k+d.zpiyxery.npoudatri.600.gpg.1.20210127014546.gpg

i need to ignore the starting x+y values and capture only the data present before dateformat and ignore everything after date(including date).

manjunathmeti — Thu, 04 Mar 2021 15:16:13 GMT

Try this:

| rex \.(?<filename>.+\.\w+\.1)

Ashwini008 — Fri, 05 Mar 2021 05:17:46 GMT

@manjunathmeti This isn't applied to my other format files like below

c+d.zptumike.ccapd1fo.600.2.20210127020002.gpg

e+0.in_zpiyintl.truntaxi.600.1.txt.5.20210127020002.gpg

can you help with regex which applies to all the mentioned format?

scelikok — Fri, 05 Mar 2021 05:41:20 GMT

Please try below;

| rex "\.(?<filename>.+)\.\d{14}"

manjunathmeti — Fri, 05 Mar 2021 06:26:04 GMT

Try this:

| rex "\.(?<filename>.+\.\w+\.\d)\."