topic Re: How to create a conditional rex statement on file extension or directory? in Splunk Search

How to create a conditional rex statement on file extension or directory?

mjones414 — Thu, 23 Apr 2020 17:04:58 GMT

I'm trying to figure out how to do a conditional rex statement that looks at a windows file path and determines if the last segment of the path has a ., it creates a field called extension, but if it doesn't end with an extension, it creates a field called directory and puts the full value (with spaces) of the last directory in the segment. Is there a way to do a conditional statement like this with rex?

Re: How to create a conditional rex statement on file extension or directory?

richgalloway — Thu, 23 Apr 2020 17:20:41 GMT

Please share some sample data and desired extractions.

Re: How to create a conditional rex statement on file extension or directory?

mjones414 — Wed, 30 Sep 2020 05:05:19 GMT

Surely 🙂

FieldName=Object

Value Examples:
c:\test directory with spaces\test_directory_with_underscores\filename (with: horrible habits).txt
c:\test directory with spaces\test_directory_with_underscores\little-child-directory

Simple rex to get file extension:

| rex field="object" "\.(?<extension>[^\.]*$)"

extension:
txt

(if extension is null, delimit by the last backslash .*$ and create a field called Directory with the value)

Directory:
(want this to be little-child-directory)

Re: How to create a conditional rex statement on file extension or directory?

cpetterborg — Thu, 23 Apr 2020 19:08:46 GMT

Given your question and the data that you have provided, I think that this "run anywhere" search shows a rex that will work as you have requested:

| makeresults | eval data="c:\test directory with spaces\test_directory_with_underscores\filename (with: horrible habits).txt|c:\test directory with spaces\test_directory_with_underscores\little-child-directory" 
| makemv delim="|" data
| mvexpand data 
| rex field=data "(\.(?<ext>[^.]+)|\\\(?<dir>[^.\\\]+))$"

This rex requires some additional backslashes to make it interpret the backslashes that might appear on the file path, but it clearly shows that you can get one or the other of the fields that you want to extract from the data. The first three lines are just setting up the data, and the last one (with the rex command) is the one with all the magic.