Splunk Search

Backslash regex WinEventLog

rafamss
Contributor

Hi guys,

I have the log below and need get the third part of the this log using regex. Can you help me with this?

String samples:

D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\e5f6c90d\cod0982712\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini

String that i want: MSRS11.MSSQLSERVER\Reporting Services\RSTempFiles\reportserver\cod0982712\311c6586\assembly\cod1\380c6db9\00776c62_b2e8cc01\__AssemblyInfo__.ini

Thanks.

0 Karma

rafamss
Contributor

Hi guys,

My mistake. I forgot said that say which the path the log can change anytime. So, I always need get the thirdy path of the EventLog.

D:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\ from here to end

0 Karma

alemarzu
Motivator

Hi there @rafamss

Try this one to grab everything after the 3rd segment.

(?:[^\\]+\\){3}(?<new_field>.*?)$

rafamss
Contributor

Hi @alemarzu,

I'm using the example below, but it's not working.

| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table field

Error in 'rex' command: Encountered the following error while compiling the regex '(?:[^]+){3}(?.*?)$': Regex: missing terminating ] for character class

0 Karma

alemarzu
Motivator

The regex from the error message is not the same I gave you.

| rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table new_field
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "(?ms).*Microsoft SQL Server\\\(?<MyField>.+)$"
0 Karma

jkat54
SplunkTrust
SplunkTrust
.*D:\\Program Files\\Microsoft SQL Server\\(?<yourFieldName>.*)

This is a bit more efficient here:

.*Server\\(?<yourFieldName>.*)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!