How can I extract information from the following source field?

[medvelsplunk]

I have the following source field C:\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\ekPRANBAI\WEB-INF\executables\bin\ekPRUEBA\WEB-INF\cache\scripts\iperf-8998.txt . I want to extract 8998 into a suc_id field

[woodcock · Accepted solution]

Like this:

| rex field=source "(?<suc_id>\d+)\.txt$"

[medvelsplunk]

Tanks Woodcock

[richgalloway]

Depending on how varied the source field can be this could work.

... | rex field=source "-(?<suc_id>[\d]+)\.txt" | ...