topic regex path without filename from source in Splunk Search

regex path without filename from source

Moritz — Mon, 03 Feb 2014 15:27:25 GMT

Hallo,
I fruitless tried to extract the path from the source field. My latest test is:

source="C:\\Users\\...\\...\\Logs\\*"   | rex field=source "(?<path>.*)\\.*$"

Re: regex path without filename from source

somesoni2 — Mon, 03 Feb 2014 16:43:10 GMT

Try this

| rex field=source "(?<path>.*)[//\\\]+.[a-zA-Z.]*"

Re: regex path without filename from source

Moritz — Tue, 04 Feb 2014 08:34:21 GMT

Thank you.
A little bit better version is:
rex field=source "(?.)[//\\\]+.[a-zA-Z.0-9]"

How is it possible to find all characters except \ in the latter part?

Re: regex path without filename from source

somesoni2 — Tue, 04 Feb 2014 14:15:01 GMT

Could you be little more specific? probably an example?

Re: regex path without filename from source

Moritz — Tue, 04 Feb 2014 15:02:05 GMT

my backslashes were deleted..

i'd like to accept in the filename all characters except the backslash. so i thougt for something like [\\][^\\]* for the last part. (i dont really understand [//\\\].)

Re: regex path without filename from source

somesoni2 — Tue, 04 Feb 2014 15:19:56 GMT

I am still not clear with the requirement. Would it be possible for your provide example. like for "C:\test\test9\some9sample.log", result should be "C:\test\test9"

Re: regex path without filename from source

rahulroy_splunk — Tue, 04 Feb 2014 16:06:52 GMT

This will also work.
| rex field=source "(?.*)[//\\\]"

Re: regex path without filename from source

Moritz — Wed, 05 Feb 2014 09:54:56 GMT

@rahulroy_splunk: this is what i was searching for. thank you! thank you somesoni2 for your help.