topic Re: regex - everything after last slash in Splunk Enterprise Security

regex - everything after last slash

jacqu3sy — Mon, 16 Dec 2019 11:34:04 GMT

Hi,

How do I write a regex to capture everything after the final \ of a file name and search for within the query?

i.e. \wtf\test\thisbithere.exe

This works on regexe101:

([^\]+$)

But trying to use inline via the following keeps failing;

| rex field=_raw "(?([^\]+$)"

any ideas?

Re: regex - everything after last slash

gcusello — Mon, 16 Dec 2019 11:41:31 GMT

Hi @jacqu3sy,
try something like this

| rex "\\(?<filename>\w+\.\w+)$"

that you can test at https://regex101.com/r/78fp97/1 .

Ciao.
Giuseppe

Re: regex - everything after last slash

jacqu3sy — Mon, 16 Dec 2019 11:49:08 GMT

hmmm, errors when I run that in Splunk though?

Re: regex - everything after last slash

gcusello — Mon, 16 Dec 2019 11:53:56 GMT

Hi @jacqu3sy,
what's error?

have you used my regex in a search or in a dashboard?
in a search it should run;
if you're using in a dashboard you have to modify the regex because the Splunk editor has some problem:

| rex "\\(?&lt;filename&gt;\w+\.\w+)$"

Ciao.
Giuseppe

Re: regex - everything after last slash

jacqu3sy — Mon, 16 Dec 2019 11:56:24 GMT

| rex "\(?\w+.\w+)$"

Error in 'rex' command: Encountered the following error while compiling the regex '(?\w+.\w+)$': Regex: unmatched closing parenthesis

Re: regex - everything after last slash

jacqu3sy — Mon, 16 Dec 2019 11:56:51 GMT

just straight from within a search

Re: regex - everything after last slash

gcusello — Mon, 16 Dec 2019 12:01:55 GMT

Hi @jacqu3sy,
you have to use two backslashes in the beginning of the regex, not one!

 | rex "\\(?<filename>\w+\.\w+)$"

P.S.:
When you have to use a regex in a message, please, use the Code Sample button (101010), otherwise it's difficoult to read your messages.

Ciao.
Giuseppe

Re: regex - everything after last slash

vnravikumar — Mon, 16 Dec 2019 12:03:34 GMT

Try this

| makeresults 
| eval temp=" \wtf\test\thisbithere.exe" 
| rex field=temp "(?P<filename>[^\\\]+)$"

| makeresults 
| eval temp="\wtf\test\thisbithere.exe" 
|eval filename =mvindex(split(temp,"\\"),-1)

Re: regex - everything after last slash

jacqu3sy — Mon, 16 Dec 2019 12:06:25 GMT

Yeh, even with the second backslash I get an error when running straight from a search query, related to 'unmatched closing parenthesis'

<mysearch>
| rex "\\(?<filename>\w+\.\w+)$"

Re: regex - everything after last slash

vnravikumar — Mon, 16 Dec 2019 12:12:31 GMT

Try my answer

Re: regex - everything after last slash

gcusello — Mon, 16 Dec 2019 12:13:20 GMT

these run:

index=_internal | head 100 | rex field=source "(?<filename>\w+\.\w+)$"

index=_internal | head 100 | rex field=source "\\\(?<filename>\w+\.\w+)$"

Ciao.
Giuseppe

Re: regex - everything after last slash

jpolvino — Mon, 16 Dec 2019 12:46:43 GMT

This works as well, leveraging positive lookbehind:

rex "(?<=\\)(?<theWord>[\w\.]+)$"

Regex101: https://regex101.com/r/eslxJR/2

Re: regex - everything after last slash

jacqu3sy — Mon, 16 Dec 2019 12:55:07 GMT

appreciate the efforts, really do. Unfortunatly I couldnt get these to work, but thanks anyway.

Re: regex - everything after last slash

jacqu3sy — Mon, 16 Dec 2019 12:55:33 GMT

Both these worked, many thanks, much appreciated.