topic Backslash regex WinEventLog in Splunk Search

Backslash regex WinEventLog

rafamss — Tue, 29 Aug 2017 21:52:13 GMT

Hi guys,

I have the log below and need get the third part of the this log using regex. Can you help me with this?

String samples:

D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini

String that i want: MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\cod0982712\311c6586\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini

Thanks.

Re: Backslash regex WinEventLog

jkat54 — Tue, 29 Aug 2017 23:52:20 GMT

.*D:\\Program Files\\Microsoft SQL Server\\(?<yourFieldName>.*)

This is a bit more efficient here:

.*Server\\(?<yourFieldName>.*)

Re: Backslash regex WinEventLog

woodcock — Wed, 30 Aug 2017 01:12:39 GMT

Like this:

... | rex "(?ms).*Microsoft SQL Server\\\(?<MyField>.+)$"

Re: Backslash regex WinEventLog

rafamss — Thu, 31 Aug 2017 14:34:19 GMT

Hi guys,

My mistake. I forgot said that say which the path the log can change anytime. So, I always need get the thirdy path of the EventLog.

D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\ from here to end

Re: Backslash regex WinEventLog

alemarzu — Thu, 31 Aug 2017 15:23:23 GMT

Hi there @rafamss

Try this one to grab everything after the 3rd segment.

(?:[^\\]+\\){3}(?<new_field>.*?)$

Re: Backslash regex WinEventLog

rafamss — Thu, 31 Aug 2017 17:16:30 GMT

Hi @alemarzu,

I'm using the example below, but it's not working.

| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table field

Error in 'rex' command: Encountered the following error while compiling the regex '(?:[^]+){3}(?.*?)$': Regex: missing terminating ] for character class

Re: Backslash regex WinEventLog

alemarzu — Thu, 31 Aug 2017 20:13:17 GMT

The regex from the error message is not the same I gave you.

| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table new_field