Hi,
We have a data source containing File Path's from both Windows and Linux formats. Applying regex separately works but how can I extract all file names regardless of format in a single search?
Following works for all Windows path's but for Linux, entire path gets extracted as file_name
| rex field=file_path "(?P<file_name>[^\\\]+)$"
whereas this one works for Linux but does nothing on the Windows path.
| rex field=file_path ".*\/(?<file_name>.*)$"
Is there a way to use both in same search? or a new regex that would work on either of the two formats?
| rex field=file_path "([^\r\n\s\\\/]+[\\\/])+(?<file_name>.*)$"
Hi
Is this what you are looking for?
| makeresults
| eval file_path="/as/bsb/asda/file.txt|c:\asda\asdadaa\aa\file.txt"
| eval file_path = split(file_path,"|")
| mvexpand file_path
``` Previous prepare sample data ```
| rex field=file_path "(?P<file_name>[^\\/\\\]+)$"
r. Ismo
| rex field=file_path "(?<file_name>[^\/\\\]+\..+)$"
Negation for / and \, match everything that has at least one dot. Tested on:
C:\test\test.tst
/test/test/test.tst
/test/test/test.tst.tst
This regex works in my limited testing.
| rex field=file_path "(?<file_name>[^\/\\]+)$"