topic Re: How can I extract a file name from a file path? in Splunk Search

How can I extract a file name from a file path?

JustRoot — Tue, 15 Aug 2017 14:20:16 GMT

Hello,

So currently, one of my indices logs has the file path which contains the file name but doesn't have a separate file name field. Is there any way to extract the filename? For example, if c:\users\user1\desktop\file.exe is my file path, I want to see file.exe.

Have:
c:\users\user1\desktop\file.exe

Want:
file.exe

Thanks

PS - I know there are other posts on this, but the solutions offered on those didn't work for me.

Re: How can I extract a file name from a file path?

cpetterborg — Tue, 15 Aug 2017 15:58:06 GMT

I'm going to assume that you have the full path in a field and that you are doing a search time extraction with the rex command. Do something like this:

<your search> | rex field=path "(?P<file>[^\\\]+)$"

If you are using the source field, then just substitute source for path.

Edited. - needed an extra backslash in the rex.

Re: How can I extract a file name from a file path?

JustRoot — Tue, 15 Aug 2017 17:00:20 GMT

This is the error I get using the exact solution you provided.

Re: How can I extract a file name from a file path?

masonmorales — Tue, 15 Aug 2017 17:29:44 GMT

Try adding another backslash, like this:

 <your search> | rex field=Process_Name "(?P<file>[^\\\]+)$"

Re: How can I extract a file name from a file path?

JustRoot — Tue, 15 Aug 2017 17:37:21 GMT

This worked, thanks!