Splunk Search

How to extract a field from a long path name?

Path Finder


We need to create a new field for file name and this is to be extracted from path we have.

We need to extract last segment from below path which is jst_cat_20170119164505.xfrfrom below path .
Format of path is as below



0 Karma


If all of these urls are in individual events then this extraction shall give you desired result:

your command to return events
| rex "\/(([^\s\/]+\/)*)(?<fileName>[\S]+)"
| table fileName

If all of these are in single event then use the max_match=0 something like this

your command to return events
| rex max_match=0 "\/(([^\s\/]+\/)*)(?<fileName>[\S]+)"
| mvexpand fileName
| table fileName
0 Karma