All Apps and Add-ons

Regex help in Field extraction

lakromani
Builder

Hi I have an FTP server that gives data in following format:

[3] Wed 23Jun14 05:00:32 - (004890) Sent file d:\ftp\info\status\security update32.rar successfully (80.0 kB/sec - 45463 Bytes)
[3] Wed 24Jun14 05:00:32 - (004896) Sent file d:\ftp\log\webserver 1 updates.rar successfully (80.0 kB/sec - 543575 Bytes)

I do like the filename logged so I use the following Field extraction

Sent file (?<FTP_File_Sent>.*) successfully

For my example this gives the following:

d:\ftp\info\status\security update32.rar
d:\ftp\log\webserver 1 updates.rar

I would like to change the regex, so that it skips also the directory and only gives:

security update32.rar
webserver 1 updates.rar

PS File name do contain spaces, and directory depth do varies.

Thanks in advance

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi lakromani,

try something like this as regex, this was tested and working on regexr

\\(.+\\)*(?<FTP_File_Sent>[\w\d\s]+\.\w+)\s

This will match from your provided examples the following strings:

d:\ftp\info\status\security update32.rar
d:\ftp\log\webserver 1 updates.rar

hope this helps ...

cheers, MuS

lakromani
Builder

Hi, Thanks for the answer, I solved it by using this: Sent file .*\\(?<FTP_File_Sent>.*) successfully

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...