Files with Multiple extensions

[Bellthazor]

I am a Splunk newbie and need to be able to search for files with multiple extensions (example: filename.ps1.doc)  and am not sure how to query this...Has anyone run across how I would go about this?  

Thanks in advance for any assistance!

[scelikok · Accepted solution]

Hi @Bellthazor,

Please try below;

| eval ext_count=mvcount(split(filename,"."))
| where ext_count>2

[richgalloway]

Perhaps the regex command will help.

... | regex field=filename "\.\w+\.\w+
"