Extracting File Type

[behymejt2012]

Hi Everyone,

Trying to extract the File Type from Files (ex: pst, xml, etc). I have tried to split it:

eval split =Split(File,".") | eval type=mvindex(split,1)

But a problem occurs when files like: "2012-12-08 15.36.01.jpg" show up due to the extra "." in the file name.

Is there any recommended rex, or method that can be used to pull the file type from the end of the File name instead of trying to split everything up.

Thanks

[Ayn · Accepted solution]

If you read the docs, they have the following to say about the mvindex command:

For mvindex(mvfield, startindex, [endindex]), endindex is inclusive and optional; both startindex and endindex can be negative, where -1 is the last element.

So, eval type=mvindex(split,-1) should do the trick.

Otherwise, if you want a rex solution, you could do

... | rex field=File "(?<type>[^.]+)$"

[Ayn]

Sorry, like it says - you need to include a group name at the beginning. I updated my answer with correct syntax.

[behymejt2012]

Thanks,

When I try and use the rex I get the following error (havent really used rex): "Error in 'rex' command: The regex '([^.]+)$' does not extract anything. It should specify at least one named group. Format: (?...)."