topic Re: How to write regex to extract a string, but ignore the last portion if a certain string is present? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-to-extract-a-string-but-ignore-the-last/m-p/179548#M51688 <P>If the format of the filename is not a fixed number of period separated names, you could use something like</P> <PRE><CODE>SourceFile\=(?P&lt;yourfield&gt;(\w+|\.)+?)(|\.\w*B00)\sDestFile\= </CODE></PRE> Tue, 04 Nov 2014 16:26:15 GMT davebrooking 2014-11-04T16:26:15Z How to write regex to extract a string, but ignore the last portion if a certain string is present? https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-to-extract-a-string-but-ignore-the-last/m-p/179546#M51686 <P>Hi All,</P> <P>Below are the two different events we have,</P> <P>1) DateTime="2014-11-04 06:42:35" SourceFile=<STRONG>ABCD.EFGH.IJKL.ABCTFILE</STRONG> DestFile=XYZA.R160001B.WERT10.A0005.H0001B00<BR /> 2) DateTime="2014-11-04 06:41:35" SourceFile=<STRONG>XYZA.ER5678A.WERT10.T0005</STRONG>.J0001B00 DestFile=XYZA.R160001B.WERT10.A0005.H0001B00</P> <P>We need to extract the string which is highlighted in BOLD from SourceFile. The rule is to ignore the complete word where <STRONG>"BOO"</STRONG> is present in end of the string(In 2nd event "J0001B00") or extract complete string if <STRONG>"BOO"</STRONG> is not present (in 1st Event)</P> <P>We wrote a regEx which will match ---&gt; (?i)SourceFile\W(.<EM>?).\w+\s<BR /> **ABCD.EFGH.IJKL</EM>* from 1st event ==&gt; here "<STRONG>ABCTFILE</STRONG>" is missing<BR /> <STRONG>XYZA.ER5678A.WERT10.T0005</STRONG> from 2nd event</P> <P>We have issues in extracting from 1st event. </P> <P><A href="http://rubular.com/r/O6tB73XSpz" target="_blank">Online RegEx Editor with above Events</A><BR /> <A href="http://rubular.com/r/O6tB73XSpz" target="_blank">http://rubular.com/r/O6tB73XSpz</A><BR /> Can any one please help to write proper regEx which will extract both string</P> <P>Thanks,<BR /> Smith</P> Mon, 28 Sep 2020 17:59:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-to-extract-a-string-but-ignore-the-last/m-p/179546#M51686 Smith_Splunk 2020-09-28T17:59:46Z Re: How to write regex to extract a string, but ignore the last portion if a certain string is present? https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-to-extract-a-string-but-ignore-the-last/m-p/179547#M51687 <P>Hello</P> <P>Try with this regex:</P> <PRE><CODE>SourceFile\=(?&lt;yourfield&gt;(\w+|\.){7})(\sDestFile|\.\w*B00\s) </CODE></PRE> <P>Regards</P> Tue, 04 Nov 2014 15:13:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-to-extract-a-string-but-ignore-the-last/m-p/179547#M51687 gfuente 2014-11-04T15:13:37Z Re: How to write regex to extract a string, but ignore the last portion if a certain string is present? https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-to-extract-a-string-but-ignore-the-last/m-p/179548#M51688 <P>If the format of the filename is not a fixed number of period separated names, you could use something like</P> <PRE><CODE>SourceFile\=(?P&lt;yourfield&gt;(\w+|\.)+?)(|\.\w*B00)\sDestFile\= </CODE></PRE> Tue, 04 Nov 2014 16:26:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-to-extract-a-string-but-ignore-the-last/m-p/179548#M51688 davebrooking 2014-11-04T16:26:15Z