Splunk Search

How can I extract a file name from a file path?

JustRoot
Path Finder

Hello,

So currently, one of my indices logs has the file path which contains the file name but doesn't have a separate file name field. Is there any way to extract the filename? For example, if c:\users\user1\desktop\file.exe is my file path, I want to see file.exe.

Have:
c:\users\user1\desktop\file.exe

Want:
file.exe

Thanks

PS - I know there are other posts on this, but the solutions offered on those didn't work for me.

0 Karma
1 Solution

masonmorales
Influencer

Try adding another backslash, like this:

 <your search> | rex field=Process_Name "(?P<file>[^\\\]+)$"

View solution in original post

masonmorales
Influencer

Try adding another backslash, like this:

 <your search> | rex field=Process_Name "(?P<file>[^\\\]+)$"

JustRoot
Path Finder

This worked, thanks!

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I'm going to assume that you have the full path in a field and that you are doing a search time extraction with the rex command. Do something like this:

<your search> | rex field=path "(?P<file>[^\\\]+)$"

If you are using the source field, then just substitute source for path.

Edited. - needed an extra backslash in the rex.

JustRoot
Path Finder

alt text

This is the error I get using the exact solution you provided.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...