topic Re: How to extract the last file name from my sample string of data? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-last-file-name-from-my-sample-string-of-data/m-p/210991#M61705 <P>Splunk does regex, too. Assuming your text is already extracted, this should pull out the last part. I've made other assumptions about the characters that start and end the desired text so you may need to adjust the regex.</P> <PRE><CODE>... | rex field=text "- (?&lt;shortcut&gt;[^\"]*)" | ... </CODE></PRE> Tue, 01 Sep 2015 16:43:59 GMT richgalloway 2015-09-01T16:43:59Z How to extract the last file name from my sample string of data? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-last-file-name-from-my-sample-string-of-data/m-p/210989#M61703 <P>Hello all, </P> <P>I have the following string:</P> <PRE><CODE>"6900 0 1024 0 0 0 0 0 0 0 C:\windows\System32\Launcher.exe "C:\windows\System32\Launcher.exe" "C:\Folder\Link - Shortcut.lnk" ", </CODE></PRE> <P>And I need a way to get the very last part (e.g.. Shortcut.lnk). Normally I would use regex for this in SQL or code, but for the life of me, I can't figure out how to implement it in Splunk.</P> <P>Any help is greatly appreciated.. </P> Tue, 01 Sep 2015 16:07:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-last-file-name-from-my-sample-string-of-data/m-p/210989#M61703 jclemons7 2015-09-01T16:07:02Z Re: How to extract the last file name from my sample string of data? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-last-file-name-from-my-sample-string-of-data/m-p/210990#M61704 <P>Can you provide a few more samples?</P> Tue, 01 Sep 2015 16:27:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-last-file-name-from-my-sample-string-of-data/m-p/210990#M61704 bmacias84 2015-09-01T16:27:34Z Re: How to extract the last file name from my sample string of data? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-last-file-name-from-my-sample-string-of-data/m-p/210991#M61705 <P>Splunk does regex, too. Assuming your text is already extracted, this should pull out the last part. I've made other assumptions about the characters that start and end the desired text so you may need to adjust the regex.</P> <PRE><CODE>... | rex field=text "- (?&lt;shortcut&gt;[^\"]*)" | ... </CODE></PRE> Tue, 01 Sep 2015 16:43:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-last-file-name-from-my-sample-string-of-data/m-p/210991#M61705 richgalloway 2015-09-01T16:43:59Z