topic Re: Get filename from path with rex in Splunk Search

Get filename from path with rex

altink — Thu, 21 Sep 2023 14:01:34 GMT

Hello

I am trying to get filename (name.exe) from a full path (dir + filename) from windows folders, ex:

C:\dir1\dir2\filename.ext

using code as below:

index = os_sysmon NOT Image="*Sysmon*" EventCode=1 | rex field=Image "Executable=(?P<Executable>[^\\\]+)$" | table Image Executable

Problem:
Executable always empty

Can you please advise?

best regards
Altin

Re: Get filename from path with rex

richgalloway — Thu, 21 Sep 2023 14:10:25 GMT

The regular expression shown could be good, but we can't tell without seeing a sample event (not just a file path).

Re: Get filename from path with rex

altink — Thu, 21 Sep 2023 14:23:30 GMT

thank you @richgalloway for the reply

attached is an example of my search

Re: Get filename from path with rex

richgalloway — Thu, 21 Sep 2023 15:55:25 GMT

Since the Image field does not contain the string "Executable=" the regular expression does not match and rex extracts nothing. Try removing "Executable=" from the command.

Re: Get filename from path with rex

altink — Thu, 21 Sep 2023 16:17:59 GMT

Thank You very much @richgalloway

As You suggested, the following worked:

index = os_sysmon NOT Image="*Sysmon*" EventCode=1 | rex field=Image "(?P<Executable>[^\\\]+)$" | table Image Executable