Getting Data In

Help with a regex (extract the file name from the file path)

kvnpichon
Path Finder

Hi Splunkers,

I need some help with a regex/command to extract the file name from the file path :

  • path\\to\\the\\file\\file_name
  • or path\\to\\the\\file\\file_name (path\\inside\\file)

Actually I have the EVAL command in my props.conf :

  • EVAL-file_name = mvindex(split(filePath,"\\"),-1)

The EVAL command working fine for most of the paths. But sometimes, the path is not common and contains  parentheses and backslashs after the file_name value...

This is some examples of unusual paths I encountered (what I want to extract is in bold) :

  • T:\\test\\FileZilla_3.47.2.1_win64_sponsored-setup.exe (NONAMEFL)
  • C:\\Users\\testuser\\Desktop\\testuser\\Local Settings\\Temporary Internet Files\\Content.IE5\\test\\ocspackage[1].exe($PLUGINSDIR\\$PLUGINSDIR\\RemCom.exe)
  • C:\\TEST\\testing\\@Archives\\@SRV\\SRV_Servers\\tests\\ocs-inventory\\OCSNG_AGENT_DEPLOYMENT_TOOL_1.0.1.2.zip ($INSTDIR\\RemCom.exe)

With my actual configuration I extract only the value after the last "\\" of the line...

Could you help me to construct that regex/command to be able to exctract the right values ?

Thanks

Labels (1)
Tags (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @kvnpichon,

Please try below in your props;

props.conf
REPORT-file_name=file_name_extract

transforms.conf
[file_name_extract]
SOURCE_KEY= filePath
REGEX= "\\\\(?<file_name>[A-Za-z0-9\._\[\]-]+\.(?:exe|zip))(?:\s|\()"
FORMAT = file_name::$1
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

kvnpichon
Path Finder

Hi, 

I tried to add your line in my props.conf file but the file_name isn't extracted as expected.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

trim(mvindex(split(mvindex(split(filePath,"("),0),"\\"),-1))

 

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...