Splunk Dev

Regex file name after space

jacqu3sy
Path Finder

Hi,

Regex wimp here...

I need to extract the file name after the word detected fro ma _raw event.

Example of _raw log;

change to a file has been detected /etc/fileinquestion.conf

I've tried the following but it errors;

| rex field=_raw "detected\s*(?*)"

Any helps appreciated. Thanks.

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

Hi can you try:

    | rex field=_raw "detected\s*(?P<filename>.*)"

View solution in original post

tiagofbmm
Influencer

Considering that your message might vary the part before the file name, i think you should use a negative lookahead style, like this

 | rex field=_raw "(?=\/)(?P<filename>.*)"

jacqu3sy
Path Finder

It works, but I'm not sure how!? Would you mind explaining what the (?=\/) achieves?

0 Karma

tiagofbmm
Influencer

It says to the regex processor to not capture anything until it finds the /.

It is more agile than assuming the logs always have the word "detected". But it's up to your specific scenario though.

If it suits you, please upvote the answer as it is a valid option

0 Karma

jacqu3sy
Path Finder

Great. Thanks.

0 Karma

p_gurav
Champion

Hi can you try:

    | rex field=_raw "detected\s*(?P<filename>.*)"

jacqu3sy
Path Finder

Worked a treat. Thanks.

0 Karma

p_gurav
Champion

Please accept answer if its helpful.. 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...