Splunk Search

How to extract the file name from full path using regex/rex?

jamesvz84
Communicator

I am trying to extract a file name from the entire path using rex. An example log is:

....request=http://66.228.48.137/malicious_file/2007-5659/21.exe....

I am using the following search:

index="devices-syslog-ng" | rex field=_raw "request=[^/]+(?[^\s]+)"

However, this is returning: //66.228.48.137/malicious_file/2007-5659/21.exe

How can I get it to just return 21.exe?

Tags (3)
0 Karma

musskopf
Builder

Hello,

assuming you have a "white space" after the filename, you could try:

index="devices-syslog-ng" | rex field=_raw "request=.+\/(?P<filename>.+)\s"

I've used the named extraction, so it will create a field named "filename".

Another option, if the field "request" is already been extracted you could try:

index="devices-syslog-ng" | rex field=request ".+\/(?P<filename>.+)\s"

Cheers,

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

There would not be a space at the end of the extracted field(request), so the second rex would need to be something like:

rex field=request "(?P<filename>[^/]+)$"

This also makes sure that only the last bit beyond the last slash (/) is placed in the filename.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...