Getting Data In

## Help with a regex (extract the file name from the file path)

Path Finder

Hi Splunkers,

I need some help with a regex/command to extract the file name from the file path :

• path\\to\\the\\file\\file_name
• or path\\to\\the\\file\\file_name (path\\inside\\file)

Actually I have the EVAL command in my props.conf :

• EVAL-file_name = mvindex(split(filePath,"\\"),-1)

The EVAL command working fine for most of the paths. But sometimes, the path is not common and contains  parentheses and backslashs after the file_name value...

This is some examples of unusual paths I encountered (what I want to extract is in bold) :

• C:\\Users\\testuser\\Desktop\\testuser\\Local Settings\\Temporary Internet Files\\Content.IE5\\test\\ocspackage[1].exe($PLUGINSDIR\\$PLUGINSDIR\\RemCom.exe)
• C:\\TEST\\testing\\@Archives\\@SRV\\SRV_Servers\\tests\\ocs-inventory\\OCSNG_AGENT_DEPLOYMENT_TOOL_1.0.1.2.zip ($INSTDIR\\RemCom.exe) With my actual configuration I extract only the value after the last "\\" of the line... Could you help me to construct that regex/command to be able to exctract the right values ? Thanks Labels (1) • ### field extraction Tags (2) Champion Hi @kvnpichon, Please try below in your props; props.conf REPORT-file_name=file_name_extract transforms.conf [file_name_extract] SOURCE_KEY= filePath REGEX= "\\\\(?<file_name>[A-Za-z0-9\._-]+\.(?:exe|zip))(?:\s|\()" FORMAT = file_name::$1
If this reply helps you an upvote is appreciated.
Path Finder

Hi,

I tried to add your line in my props.conf file but the file_name isn't extracted as expected.

Legend

trim(mvindex(split(mvindex(split(filePath,"("),0),"\\"),-1))

.conf21 Now Fully Virtual!