Splunk Search

How can I extract a file name from a file path?

JustRoot
Path Finder

Hello,

So currently, one of my indices logs has the file path which contains the file name but doesn't have a separate file name field. Is there any way to extract the filename? For example, if c:\users\user1\desktop\file.exe is my file path, I want to see file.exe.

Have:
c:\users\user1\desktop\file.exe

Want:
file.exe

Thanks

PS - I know there are other posts on this, but the solutions offered on those didn't work for me.

0 Karma
1 Solution

masonmorales
Influencer

Try adding another backslash, like this:

 <your search> | rex field=Process_Name "(?P<file>[^\\\]+)$"

View solution in original post

masonmorales
Influencer

Try adding another backslash, like this:

 <your search> | rex field=Process_Name "(?P<file>[^\\\]+)$"

JustRoot
Path Finder

This worked, thanks!

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I'm going to assume that you have the full path in a field and that you are doing a search time extraction with the rex command. Do something like this:

<your search> | rex field=path "(?P<file>[^\\\]+)$"

If you are using the source field, then just substitute source for path.

Edited. - needed an extra backslash in the rex.

JustRoot
Path Finder

alt text

This is the error I get using the exact solution you provided.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...