Splunk Search

Can anyone help me split this field into 2?

New Member

Hi!

temp=C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe

to...

path=C:\Program Files\SplunkUniversalForwarder\bin
process=splunk-powershell.exe

this is what I reach...

I'm stuck at the regex.

Any other method is also appreciated

| rex field=temp "(?[^\\\/]*)$"    |regex path=!temp    |table FILENAME,PATH
0 Karma
1 Solution

Super Champion

(pls check this.. very manual rex,..

| makeresults 
| eval temp="C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" 
| rex field=temp "(?P<path>\w+\W+\w+\W\w+\W\w+\W\w+\W)(?P<fileName>\w+\W\w+\W\w+)"
| table path fileName

alt text

PS - if it resolves your task, pls accept this as answer

View solution in original post

Super Champion

(pls check this.. very manual rex,..

| makeresults 
| eval temp="C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" 
| rex field=temp "(?P<path>\w+\W+\w+\W\w+\W\w+\W\w+\W)(?P<fileName>\w+\W\w+\W\w+)"
| table path fileName

alt text

PS - if it resolves your task, pls accept this as answer

View solution in original post

SplunkTrust
SplunkTrust

Try this:

(?<path>.*)\\(?<file>[^\\]*)$
------------
Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!