How to completely remove/not select the directory path if it "remote" in its folder structure?

[DataOrg]

How to completely remove/not select the directory path if it "remote" in its folder structure  

my regex --- specification|Cu Req|Cu Spec|02 - Regulatory|\\*\\remote||

directory struture 

/specification/Cu Req/remote/value --- remove complete path

/specification/system/val_remote/cmd/system - remove since its has word as "remote"

/specification/system/value/remote--- remove the path

/specification /system/value/cmd/sys32 - consider

[kamlesh_vaghela]

@DataOrg 

Can you please share some example values ( as per your use cases) and expected output?

KV

🙂 

[ITWhisperer]

If I understand correctly, you only want events where the directory field does not contain "remote"?

| regex directory!="remote"

[DataOrg]

Need to remove the path before forming up in the file.

https://regex101.com/r/xcKiSe/1

[ITWhisperer]

I am not clear what you are trying to do here. Do you want to remove "remote" from a field, or remove events with "remote" in a field or something else?

[DataOrg]

@ITWhisperer i am writing a script which only the specific directory is considered.

for example  the folder structure is formed like this  /spec/abs/remote  so while forming when remote is there in a directory it should not write the directory

[ITWhisperer]

What has this to do with splunk?

What language are you writing the script in?

Where does the file path come from?