How to extract filename from fields?

[dhirendra761]

I am trying to extract a filename Nsences_2016_10_10_12_50.csv from below field value.

D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete." 
| rex field=raw_field "D:\\(.+\\)*(?<filename>.*)\.csv Complete, status : 226 Transfer complete.

I am extracting as below.

| makeresults 
| eval raw_field="D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete." 
| rex field=raw_field "D:\\(.+\\)*(?<filename>.*)\.csv Complete, status : 226 Transfer complete." 
| table raw_field filename

Please help me. Thanks in advance.

Dhirendra

[vinod94]

| makeresults 
| eval date="D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete." 
| rex field=date "\\\Files.*\\\(?P<filename>.+)\s\w+,"

[dhirendra761]

Thank you for your answer @vinod94

[harsmarvania57 · Accepted solution]

Hi,

Please try below regex.

<yourBaseSearch>
| rex field=<yourfield> "\x5c(?<filename>[^\x5c]+\.[^\s]+)"

[dhirendra761]

Thanks @harsmarvania57 for your answer 🙂

[harsmarvania57]

Welcome 🙂