Splunk Search

Backslash regex WinEventLog

rafamss
Contributor

Hi guys,

I have the log below and need get the third part of the this log using regex. Can you help me with this?

String samples:

D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini

String that i want: MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\cod0982712\311c6586\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini

Thanks.

0 Karma

rafamss
Contributor

Hi guys,

My mistake. I forgot said that say which the path the log can change anytime. So, I always need get the thirdy path of the EventLog.

D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\ from here to end

0 Karma

alemarzu
Motivator

Hi there @rafamss

Try this one to grab everything after the 3rd segment.

(?:[^\\]+\\){3}(?<new_field>.*?)$

rafamss
Contributor

Hi @alemarzu,

I'm using the example below, but it's not working.

| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table field

Error in 'rex' command: Encountered the following error while compiling the regex '(?:[^]+){3}(?.*?)$': Regex: missing terminating ] for character class

0 Karma

alemarzu
Motivator

The regex from the error message is not the same I gave you.

| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table new_field
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "(?ms).*Microsoft SQL Server\\\(?<MyField>.+)$"
0 Karma

jkat54
SplunkTrust
SplunkTrust
.*D:\\Program Files\\Microsoft SQL Server\\(?<yourFieldName>.*)

This is a bit more efficient here:

.*Server\\(?<yourFieldName>.*)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...