Splunk Search

How to extract some fields from an existing field which has backslashes?

pavanae
Builder

I have a field called folder_path which gives the values as follows.

folder_path
\Device\XYZ\Users\user_A\AppData\program\Send to OneNote.lnk
\Device\RTF\Users\user_B\AppData\program\send to file.Ink

 

Now I wanted to extract the following fields from the field "folder_path"

username file_destination
user_A Send to OneNote.lnk
user_B send to file.Ink

 

whereas for extracting username as shown in the example it is extracted after the string "Users\", Simmilarly for extracting file_destination as shown in the example it is extracted after the lastbackslash ?

 

trying a few ways but couldn't properly extract the fields since it has backslashes.

Labels (6)
0 Karma
1 Solution

yeahnah
Motivator

Hi @pavanae 

Yes, backslashes is a special character in regex so needs to be escaped with another backslash, which is the escape character in regex.  However, in the Splunk UI you also need to backslash the escaping backslash for it to work.   A bit confusing for sure, but the following work anywhere example will hopefully get you going...  

| makeresults | eval folder_path="\Device\XYZ\Users\user_A\AppData\program\Send to OneNote.lnk"
| rex field=folder_path "Users\\\(?<username>[^\\\]+).+?\\\(?<file_destination>.*)"

 

View solution in original post

pavanae
Builder

Thanks a Lot @yeahnah . Although the field extraction for file_destination isn't working as expected. As you see below file destnation is extracting "program\Send to OneNote.lnk" but I just wanted to extract "Send to OneNote.lnk" just the last file name which comes at the end of the field and just after the last backslash. 

pavanae_0-1676054085282.png

 

0 Karma

yeahnah
Motivator

You're right.  This should extract the filename correctly... 

| makeresults | eval folder_path="\Device\XYZ\Users\user_A\AppData\program\Send to OneNote.lnk"
| rex field=folder_path "Users\\\(?<username>[^\\\]+).*\\\(?<file_destination>.*)"

 

0 Karma

yeahnah
Motivator

Hi @pavanae 

Yes, backslashes is a special character in regex so needs to be escaped with another backslash, which is the escape character in regex.  However, in the Splunk UI you also need to backslash the escaping backslash for it to work.   A bit confusing for sure, but the following work anywhere example will hopefully get you going...  

| makeresults | eval folder_path="\Device\XYZ\Users\user_A\AppData\program\Send to OneNote.lnk"
| rex field=folder_path "Users\\\(?<username>[^\\\]+).+?\\\(?<file_destination>.*)"

 

Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...