Getting Data In

Help with a regex (extract the file name from the file path)

kvnpichon
Path Finder

Hi Splunkers,

I need some help with a regex/command to extract the file name from the file path :

  • path\\to\\the\\file\\file_name
  • or path\\to\\the\\file\\file_name (path\\inside\\file)

Actually I have the EVAL command in my props.conf :

  • EVAL-file_name = mvindex(split(filePath,"\\"),-1)

The EVAL command working fine for most of the paths. But sometimes, the path is not common and contains  parentheses and backslashs after the file_name value...

This is some examples of unusual paths I encountered (what I want to extract is in bold) :

  • T:\\test\\FileZilla_3.47.2.1_win64_sponsored-setup.exe (NONAMEFL)
  • C:\\Users\\testuser\\Desktop\\testuser\\Local Settings\\Temporary Internet Files\\Content.IE5\\test\\ocspackage[1].exe($PLUGINSDIR\\$PLUGINSDIR\\RemCom.exe)
  • C:\\TEST\\testing\\@Archives\\@SRV\\SRV_Servers\\tests\\ocs-inventory\\OCSNG_AGENT_DEPLOYMENT_TOOL_1.0.1.2.zip ($INSTDIR\\RemCom.exe)

With my actual configuration I extract only the value after the last "\\" of the line...

Could you help me to construct that regex/command to be able to exctract the right values ?

Thanks

Labels (1)
Tags (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @kvnpichon,

Please try below in your props;

props.conf
REPORT-file_name=file_name_extract

transforms.conf
[file_name_extract]
SOURCE_KEY= filePath
REGEX= "\\\\(?<file_name>[A-Za-z0-9\._\[\]-]+\.(?:exe|zip))(?:\s|\()"
FORMAT = file_name::$1
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

kvnpichon
Path Finder

Hi, 

I tried to add your line in my props.conf file but the file_name isn't extracted as expected.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

trim(mvindex(split(mvindex(split(filePath,"("),0),"\\"),-1))

 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...