Splunk Enterprise Security

regex - everything after last slash

Path Finder

Hi,

How do I write a regex to capture everything after the final \ of a file name and search for within the query?

i.e. \wtf\test\thisbithere.exe

This works on regexe101:

([^\]+$)

But trying to use inline via the following keeps failing;

| rex field=_raw "(?([^\]+$)"

any ideas?

0 Karma
1 Solution

Champion

Hi

Try this

| makeresults 
| eval temp=" \wtf\test\thisbithere.exe" 
| rex field=temp "(?P<filename>[^\\\]+)$" 

or

| makeresults 
| eval temp="\wtf\test\thisbithere.exe" 
|eval filename =mvindex(split(temp,"\\"),-1)

View solution in original post

0 Karma

Builder

This works as well, leveraging positive lookbehind:

rex "(?<=\\)(?<theWord>[\w\.]+)$"

Regex101: https://regex101.com/r/eslxJR/2

0 Karma

Champion

Hi

Try this

| makeresults 
| eval temp=" \wtf\test\thisbithere.exe" 
| rex field=temp "(?P<filename>[^\\\]+)$" 

or

| makeresults 
| eval temp="\wtf\test\thisbithere.exe" 
|eval filename =mvindex(split(temp,"\\"),-1)

View solution in original post

0 Karma

Champion

Try my answer

0 Karma

Path Finder

Both these worked, many thanks, much appreciated.

0 Karma

Legend

Hi @jacqu3sy,
try something like this

| rex "\\(?<filename>\w+\.\w+)$"

that you can test at https://regex101.com/r/78fp97/1 .

Ciao.
Giuseppe

0 Karma

Path Finder

hmmm, errors when I run that in Splunk though?

0 Karma

Legend

Hi @jacqu3sy,
what's error?

have you used my regex in a search or in a dashboard?
in a search it should run;
if you're using in a dashboard you have to modify the regex because the Splunk editor has some problem:

| rex "\\(?&lt;filename&gt;\w+\.\w+)$"

Ciao.
Giuseppe

0 Karma

Path Finder

| rex "\(?\w+.\w+)$"

Error in 'rex' command: Encountered the following error while compiling the regex '(?\w+.\w+)$': Regex: unmatched closing parenthesis

0 Karma

Legend

Hi @jacqu3sy,
you have to use two backslashes in the beginning of the regex, not one!

 | rex "\\(?<filename>\w+\.\w+)$"

P.S.:
When you have to use a regex in a message, please, use the Code Sample button (101010), otherwise it's difficoult to read your messages.

Ciao.
Giuseppe

0 Karma

Path Finder

Yeh, even with the second backslash I get an error when running straight from a search query, related to 'unmatched closing parenthesis'

<mysearch>
| rex "\\(?<filename>\w+\.\w+)$"
0 Karma

Legend

these run:

index=_internal | head 100 | rex field=source "(?<filename>\w+\.\w+)$"

or

index=_internal | head 100 | rex field=source "\\\(?<filename>\w+\.\w+)$"

Ciao.
Giuseppe

0 Karma

Path Finder

appreciate the efforts, really do. Unfortunatly I couldnt get these to work, but thanks anyway.

0 Karma

Path Finder

just straight from within a search

0 Karma