https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-specific-part-for-data-from-the-file-path/m-p/601817#M209449 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;,</P><P>&nbsp; &nbsp;Thanks for your response, It worked.</P> Wed, 15 Jun 2022 06:27:19 GMT smanojkumar 2022-06-15T06:27:19Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-specific-part-for-data-from-the-file-path/m-p/601811#M209446 <P>To extract the specific part for data from the file path,</P> <TABLE> <TBODY> <TR> <TD>C:/Users/USSACDev/AppData/Local/Temp/WindowsAETemp/<STRONG>35018_2225424_1655272292585</STRONG></TD> </TR> <TR> <TD>C:/Users/USSACDev/AppData/Local/Temp/WindowsAETemp/<STRONG>35018_2225421_1655272247058</STRONG></TD> </TR> </TBODY> </TABLE> <P><BR />The bolded part should be extracted, as i already extracted by a regex command,<BR />| rex "\"aeci\".*\"temp_path\":\s+\"(?&lt;activity_id&gt;[^\"]+)"<BR />By the above command, I got the file path, In that i need the specifies bolded part,<BR /><BR />Can anyone help in this, Provide the single regex command that should include above specified regex command, like, it should be from, aeci (used in above regex)<BR />.</P> Wed, 15 Jun 2022 17:39:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-specific-part-for-data-from-the-file-path/m-p/601811#M209446 smanojkumar 2022-06-15T17:39:32Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-specific-part-for-data-from-the-file-path/m-p/601814#M209447 <P>Does this work for you?</P><LI-CODE lang="markup">| rex "\"aeci\".*\"temp_path\":\s+\".*?\/(?&lt;activity_id&gt;[^\"\/]+)\""</LI-CODE> Wed, 15 Jun 2022 06:25:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-specific-part-for-data-from-the-file-path/m-p/601814#M209447 ITWhisperer 2022-06-15T06:25:35Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-specific-part-for-data-from-the-file-path/m-p/601817#M209449 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;,</P><P>&nbsp; &nbsp;Thanks for your response, It worked.</P> Wed, 15 Jun 2022 06:27:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-specific-part-for-data-from-the-file-path/m-p/601817#M209449 smanojkumar 2022-06-15T06:27:19Z