topic Can anyone help me split this field into 2? in Splunk Search

Can anyone help me split this field into 2?

hok2010 — Wed, 17 Oct 2018 11:01:37 GMT

Hi!

temp=C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe

to...

path=C:\Program Files\SplunkUniversalForwarder\bin
process=splunk-powershell.exe

this is what I reach...

I'm stuck at the regex.

Any other method is also appreciated

| rex field=temp "(?[^\\\/]*)$"    |regex path=!temp    |table FILENAME,PATH

Re: Can anyone help me split this field into 2?

diogofgm — Wed, 17 Oct 2018 11:21:55 GMT

Try this:

(?<path>.*)\\(?<file>[^\\]*)$

Re: Can anyone help me split this field into 2?

inventsekar — Wed, 17 Oct 2018 12:16:02 GMT

(pls check this.. very manual rex,..

| makeresults 
| eval temp="C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" 
| rex field=temp "(?P<path>\w+\W+\w+\W\w+\W\w+\W\w+\W)(?P<fileName>\w+\W\w+\W\w+)"
| table path fileName

PS - if it resolves your task, pls accept this as answer