McAfee ePO Logs question

[MFiller90]

I am ingesting McAfee ePO logs from several endpoints.

We have an eval command that works pretty well by coalescing all the file paths into this 1 eval command.

EVAL-file_path = coalesce(file_path1,filepath2,filepath_3)

Each of these file paths end up looking something like:
\Path\to\file\filename.exe
\Path\to\file\filename.log

I wanted to try and extract that "filename.exe" by itself and give it its own field.

[sduff_splunk]

rex field=file_path "(?<filename>[^\\]*)$"

That should extract the last segment (i.e., the filename) from the file path

[MFiller90]

We're trying to make this a field via a search time extraction. If I could somehow grab that rex command and throw it into an eval, that would be great, but looking over the EVAL documentation, it doesnt look like thats supported.

[sduff_splunk]

You dont need to put it into an eval. If you use | rex ... |, the filename is a field that is created