Extract filename from source

[vincenty]

I am trying do a search for all exceptions and list the associated filename instead of the whole path+filename in my results table.

I tried the following in my search but it didn't work:
Exception sourcetype=qagadc1 | rex ".?(?(?:\w+.)+\w?Exception)." | rex field=source "(?(/\w)+)/+(?\w+)+.*" |table source fname

my source structure is not unique, they are varies as follow:
/home/d1/d2/d3/fn1.log
/home/d1/d2/d3/d4/d5/fn2.out
/home/d1/d2/d3/d4/d5/d6/fn3.log

...

please help.

[koshyk]

In case if your filename contains a . then

# For Unix style
| rex field=<fieldname> "/(?<newField>[\w\d\.]+$)"

[martin_mueller]

That's just a matter of modifying the expression, see my edited answer.

[vincenty]

actually, I am trying to get the filename extension (i.e fn2.out, fn3.log) as part of the "fname" returned.

Tried appending what you suggested still does not give me fn3.log, or fn2.out etc.

[vincenty]

actually, I am trying to get the filename extension (i.e fn2.out, fn3.log) as part of the "fname" returned.

Tried appending what you suggested still does not give me fn3.log, or fn2.out etc.

[vincenty]

actually, I am trying to get the filename extension (i.e fn2.out, fn3.log) as part of the "fname" returned.

Tried appending what you suggested still does not give me fn3.log, or fn2.out etc.

[martin_mueller]

To extract the last segment of a path from a field you can append this to your search:

 | eval field = replace(field, ".*/", "")

Edit: If you want the last bit after the final dot you can modify the expression like this:

  | eval field = replace(field, ".*\.", "")