https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434065#M123918 <PRE><CODE>| makeresults | eval date="D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete." | rex field=date "\\\Files.*\\\(?P&lt;filename&gt;.+)\s\w+," </CODE></PRE> Wed, 19 Jun 2019 08:18:15 GMT vinod94 2019-06-19T08:18:15Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434063#M123916 <P>I am trying to extract a filename <STRONG>Nsences_2016_10_10_12_50.csv</STRONG> from below field value.</P> <PRE><CODE>D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete." | rex field=raw_field "D:\\(.+\\)*(?&lt;filename&gt;.*)\.csv Complete, status : 226 Transfer complete. </CODE></PRE> <P>I am extracting as below.</P> <PRE><CODE>| makeresults | eval raw_field="D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete." | rex field=raw_field "D:\\(.+\\)*(?&lt;filename&gt;.*)\.csv Complete, status : 226 Transfer complete." | table raw_field filename </CODE></PRE> <P>Please help me. Thanks in advance.</P> <P>Dhirendra</P> Wed, 30 Sep 2020 01:00:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434063#M123916 dhirendra761 2020-09-30T01:00:20Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434064#M123917 <P>Hi,</P> <P>Please try below regex.</P> <PRE><CODE>&lt;yourBaseSearch&gt; | rex field=&lt;yourfield&gt; "\x5c(?&lt;filename&gt;[^\x5c]+\.[^\s]+)" </CODE></PRE> Wed, 19 Jun 2019 07:50:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434064#M123917 harsmarvania57 2019-06-19T07:50:45Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434065#M123918 <PRE><CODE>| makeresults | eval date="D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete." | rex field=date "\\\Files.*\\\(?P&lt;filename&gt;.+)\s\w+," </CODE></PRE> Wed, 19 Jun 2019 08:18:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434065#M123918 vinod94 2019-06-19T08:18:15Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434066#M123919 <P>Thanks @harsmarvania57 for your answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 19 Jun 2019 09:48:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434066#M123919 dhirendra761 2019-06-19T09:48:24Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434067#M123920 <P>Thank you for your answer @vinod94 </P> Wed, 19 Jun 2019 09:48:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434067#M123920 dhirendra761 2019-06-19T09:48:44Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434068#M123921 <P>Welcome <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 19 Jun 2019 11:41:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-filename-from-fields/m-p/434068#M123921 harsmarvania57 2019-06-19T11:41:03Z