rex syntax to parse source path for a sub-directory name and the file name

[vincenty]

I am trying to parse source path for a sub-directory name and its file name. My source files are as follows:

source=/home/sd1/sd2/sd3/(subdir1)/file1.out
source=/home/sd1/sd2/sd3/(subdir1)/sd4/file2.log
source=/home/sd1/sd2/sd3/(subdir1)/sd4/sd5/file3.out
source=/home/sd1/sd2/sd3/(subdir1)/sd4/sd5/sd6/file4.out

I can't seem to get the syntax correct with the following:

Exception sourcetype=EDGDC2 | rex ".*?(?<exception>(?:\w+\.)+\w*?Exception).*" | rex field=source "(/\w*)+(/\w*)+(/\w*)+(/\w*)+(?<subdir1>(/\w*))+/+(?<fname>(\w*+\.+\w*))+" | stats count by exception, subdir1

The above rex will always get the last sub-directory where the file is. Tried several different variation but the above is the closest I get...

[kristian_kolb]

rex field=source "(/[^/]+){4}/(?<subdir1>[^/]+)/.*/(?<fname>.*)$"

should work.

EDIT: missed that you wanted the filename as well...

/k