How to extract some fields from an existing field which has backslashes?

[pavanae]

I have a field called folder_path which gives the values as follows.

folder_path

\Device\XYZ\Users\user_A\AppData\program\Send to OneNote.lnk

\Device\RTF\Users\user_B\AppData\program\send to file.Ink

Now I wanted to extract the following fields from the field "folder_path"

username	file_destination
user_A	Send to OneNote.lnk
user_B	send to file.Ink

whereas for extracting username as shown in the example it is extracted after the string "Users\", Simmilarly for extracting file_destination as shown in the example it is extracted after the lastbackslash ?

trying a few ways but couldn't properly extract the fields since it has backslashes.

[pavanae]

Thanks a Lot @yeahnah . Although the field extraction for file_destination isn't working as expected. As you see below file destnation is extracting "program\Send to OneNote.lnk" but I just wanted to extract "Send to OneNote.lnk" just the last file name which comes at the end of the field and just after the last backslash. 

[yeahnah]

You're right.  This should extract the filename correctly... 

| makeresults | eval folder_path="\Device\XYZ\Users\user_A\AppData\program\Send to OneNote.lnk"
| rex field=folder_path "Users\\\(?<username>[^\\\]+).*\\\(?<file_destination>.*)"

[yeahnah · Accepted solution]

Hi @pavanae 

Yes, backslashes is a special character in regex so needs to be escaped with another backslash, which is the escape character in regex.  However, in the Splunk UI you also need to backslash the escaping backslash for it to work.   A bit confusing for sure, but the following work anywhere example will hopefully get you going...  

| makeresults | eval folder_path="\Device\XYZ\Users\user_A\AppData\program\Send to OneNote.lnk"
| rex field=folder_path "Users\\\(?<username>[^\\\]+).+?\\\(?<file_destination>.*)"