Hi guys,
I have the log below and need get the third part of the this log using regex. Can you help me with this?
String samples:
D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini
String that i want: MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\cod0982712\311c6586\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini
Thanks.
Hi guys,
My mistake. I forgot said that say which the path the log can change anytime. So, I always need get the thirdy path of the EventLog.
D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\
from here to end
Hi there @rafamss
Try this one to grab everything after the 3rd segment.
(?:[^\\]+\\){3}(?<new_field>.*?)$
Hi @alemarzu,
I'm using the example below, but it's not working.
| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table field
Error in 'rex' command: Encountered the following error while compiling the regex '(?:[^]+){3}(?.*?)$': Regex: missing terminating ] for character class
The regex from the error message is not the same I gave you.
| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table new_field
Like this:
... | rex "(?ms).*Microsoft SQL Server\\\(?<MyField>.+)$"
.*D:\\Program Files\\Microsoft SQL Server\\(?<yourFieldName>.*)
This is a bit more efficient here:
.*Server\\(?<yourFieldName>.*)