Splunk Search

Can anyone help me split this field into 2?

New Member

Hi!

temp=C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe

to...

path=C:\Program Files\SplunkUniversalForwarder\bin
process=splunk-powershell.exe

this is what I reach...

I'm stuck at the regex.

Any other method is also appreciated

| rex field=temp "(?[^\\\/]*)$"    |regex path=!temp    |table FILENAME,PATH
0 Karma
1 Solution

Super Champion

(pls check this.. very manual rex,..

| makeresults 
| eval temp="C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" 
| rex field=temp "(?P<path>\w+\W+\w+\W\w+\W\w+\W\w+\W)(?P<fileName>\w+\W\w+\W\w+)"
| table path fileName

alt text

PS - if it resolves your task, pls accept this as answer

View solution in original post

Super Champion

(pls check this.. very manual rex,..

| makeresults 
| eval temp="C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" 
| rex field=temp "(?P<path>\w+\W+\w+\W\w+\W\w+\W\w+\W)(?P<fileName>\w+\W\w+\W\w+)"
| table path fileName

alt text

PS - if it resolves your task, pls accept this as answer

View solution in original post

Motivator

Try this:

(?<path>.*)\\(?<file>[^\\]*)$
------------
Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma