topic Re: Files with Multiple extensions in Splunk Search

Files with Multiple extensions

Bellthazor — Mon, 01 Feb 2021 15:43:49 GMT

I am a Splunk newbie and need to be able to search for files with multiple extensions (example: filename.ps1.doc) and am not sure how to query this...Has anyone run across how I would go about this?

Thanks in advance for any assistance!

Re: Files with Multiple extensions

richgalloway — Mon, 01 Feb 2021 15:28:18 GMT

Perhaps the regex command will help.

... | regex field=filename "\.\w+\.\w+ "

Re: Files with Multiple extensions

scelikok — Mon, 01 Feb 2021 15:29:19 GMT

Hi @Bellthazor,

Please try below;

| eval ext_count=mvcount(split(filename,".")) | where ext_count>2