topic Re: How to rex a uri path in order to get a filename with certian extensions lik .pdf .exe .zip in Splunk Search

How to rex a uri path in order to get a filename with certian extensions lik .pdf .exe .zip

alexburst37 — Tue, 29 Sep 2020 13:21:45 GMT

Right now Im using

rex field=cs_uri_path "^.*\/(?[^.\/]+.(?:[^.\/]){3,4})$"

but im missing files like blah.1.0.8file.exe
and double extensions like .pdf.exe

I cant seem to adjust to pick out these exceptions

Re: How to rex a uri path in order to get a filename with certian extensions lik .pdf .exe .zip

woodcock — Mon, 27 Mar 2017 17:23:23 GMT

Try this:

... | rex field=cs_uri_path "(?ms)(?<filename>[^\\\/\r\n\s]+)[\r\n$]"

Also try this app:

https://splunkbase.splunk.com/app/2734/

Re: How to rex a uri path in order to get a filename with certian extensions lik .pdf .exe .zip

skoelpin — Mon, 27 Mar 2017 17:26:22 GMT

Try this

... | rex (?<cs_uri_path>\S+)(?<=\.exe)

Re: How to rex a uri path in order to get a filename with certian extensions lik .pdf .exe .zip

alexburst37 — Mon, 27 Mar 2017 17:29:07 GMT

That one wont work.
This is what I am using and it works fine i just need to have it be able to pick up files that may have "." in there names like blah1.0.8update.exe

"^.*\/(?[^.\/]+.(?:[^.\/]){3,4})$"

Re: How to rex a uri path in order to get a filename with certian extensions lik .pdf .exe .zip

woodcock — Mon, 27 Mar 2017 17:49:09 GMT

Why won't it work? Your seems tediously overcomplicated. Give me the exception where the simpler one fails.