Getting Data In

Help with a regex (extract the file name from the file path)

kvnpichon
Path Finder

Hi Splunkers,

I need some help with a regex/command to extract the file name from the file path :

  • path\\to\\the\\file\\file_name
  • or path\\to\\the\\file\\file_name (path\\inside\\file)

Actually I have the EVAL command in my props.conf :

  • EVAL-file_name = mvindex(split(filePath,"\\"),-1)

The EVAL command working fine for most of the paths. But sometimes, the path is not common and contains  parentheses and backslashs after the file_name value...

This is some examples of unusual paths I encountered (what I want to extract is in bold) :

  • T:\\test\\FileZilla_3.47.2.1_win64_sponsored-setup.exe (NONAMEFL)
  • C:\\Users\\testuser\\Desktop\\testuser\\Local Settings\\Temporary Internet Files\\Content.IE5\\test\\ocspackage[1].exe($PLUGINSDIR\\$PLUGINSDIR\\RemCom.exe)
  • C:\\TEST\\testing\\@Archives\\@SRV\\SRV_Servers\\tests\\ocs-inventory\\OCSNG_AGENT_DEPLOYMENT_TOOL_1.0.1.2.zip ($INSTDIR\\RemCom.exe)

With my actual configuration I extract only the value after the last "\\" of the line...

Could you help me to construct that regex/command to be able to exctract the right values ?

Thanks

Labels (1)
Tags (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @kvnpichon,

Please try below in your props;

props.conf
REPORT-file_name=file_name_extract

transforms.conf
[file_name_extract]
SOURCE_KEY= filePath
REGEX= "\\\\(?<file_name>[A-Za-z0-9\._\[\]-]+\.(?:exe|zip))(?:\s|\()"
FORMAT = file_name::$1
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

kvnpichon
Path Finder

Hi, 

I tried to add your line in my props.conf file but the file_name isn't extracted as expected.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

trim(mvindex(split(mvindex(split(filePath,"("),0),"\\"),-1))

 

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...