How to extract specific filename from the lookup ?

[Ashwini008]

I have the following lookup and have to extract only the bold part which is my filename.

inputLookupname -Trans.log

Tue Feb 23 11:12:54 IST 2021 - trans_file.sh zouttime.gcaswb8o.600 starts
202102231112: /satn/PRY/qoutsa/zpittime.gcaswb8o.600.20210223111125 was moved to INPUT
Tue Feb 23 11:12:54 IST 2021 - trans_file.sh zxtytime.glk1a03o.600 starts
202102231112: /satn/PRY/qoutsa/zpittime.gov1a03o.600.20210223105623 was moved to INPUT

How do i capture only the the filename which is in bold?

[manjunathmeti]

Looks like this is in the index, you can use rex command to extract highlighted text in a field myfield.

| rex "\.sh\s(?<myfield>[^\s]+)"

If this reply helps you, an upvote/like would be appreciated.

[Ashwini008]

@manjunathmeti Thank you. It worked. Can you tell me how the  expression is working basically? Like if there any basic rules on understanding regex expression or how it works!

[manjunathmeti]

\.sh matches the character .sh literally 

\s matches any whitespace character.

Named Capture Group myfield 

(?<myfield>[^\s]+)

Match a single character not present in the list below 

[^\s]+

+ Quantifier — Matches between one and unlimited times, as many times as possible, giving back as needed (greedy)

[^\s]+ matches 1 or more characters except whitespace. So it will match all the characters before space.

[Ashwini008]

@manjunathmeti Great. Adding to that. I have below filename where i need to capture only the bold part.But all these files are in the same location.i cannot use single regex that applies to all the below file format.

How do i proceed on capturing the required format?

worldtime.xml.1
ztymp.txt.1
molu.dat.1
jss_pyuroly_7.dat.1
zpiyzygh.rtnugbhti.1
AD.CD.MBOUDN.1
DM.DEVT.IYP.IN.1
in_zpiyrmlu.rage.600.1.txt.1
in_soledt.pou.til.ssn.gpg.1.txt.1

zprunsledSCALLb1.prn.1