Splunk Search

How can I extract a file name from a file path?

JustRoot
Path Finder

Hello,

So currently, one of my indices logs has the file path which contains the file name but doesn't have a separate file name field. Is there any way to extract the filename? For example, if c:\users\user1\desktop\file.exe is my file path, I want to see file.exe.

Have:
c:\users\user1\desktop\file.exe

Want:
file.exe

Thanks

PS - I know there are other posts on this, but the solutions offered on those didn't work for me.

0 Karma
1 Solution

masonmorales
Influencer

Try adding another backslash, like this:

 <your search> | rex field=Process_Name "(?P<file>[^\\\]+)$"

View solution in original post

masonmorales
Influencer

Try adding another backslash, like this:

 <your search> | rex field=Process_Name "(?P<file>[^\\\]+)$"

JustRoot
Path Finder

This worked, thanks!

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I'm going to assume that you have the full path in a field and that you are doing a search time extraction with the rex command. Do something like this:

<your search> | rex field=path "(?P<file>[^\\\]+)$"

If you are using the source field, then just substitute source for path.

Edited. - needed an extra backslash in the rex.

JustRoot
Path Finder

alt text

This is the error I get using the exact solution you provided.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...