Backslash regex WinEventLog

[rafamss]

Hi guys,

I have the log below and need get the third part of the this log using regex. Can you help me with this?

String samples:

D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini

String that i want: MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\cod0982712\311c6586\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini

Thanks.

[rafamss]

Hi guys,

My mistake. I forgot said that say which the path the log can change anytime. So, I always need get the thirdy path of the EventLog.

D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\ from here to end

[alemarzu]

Hi there @rafamss

Try this one to grab everything after the 3rd segment.

(?:[^\\]+\\){3}(?<new_field>.*?)$

[rafamss]

Hi @alemarzu,

I'm using the example below, but it's not working.

| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table field

Error in 'rex' command: Encountered the following error while compiling the regex '(?:[^]+){3}(?.*?)$': Regex: missing terminating ] for character class

[alemarzu]

The regex from the error message is not the same I gave you.

| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table new_field

[woodcock]

Like this:

... | rex "(?ms).*Microsoft SQL Server\\\(?<MyField>.+)$"

[jkat54]

.*D:\\Program Files\\Microsoft SQL Server\\(?<yourFieldName>.*)

This is a bit more efficient here:

.*Server\\(?<yourFieldName>.*)