To extract the specific part for data from the file path,
C:/Users/USSACDev/AppData/Local/Temp/WindowsAETemp/35018_2225424_1655272292585 |
C:/Users/USSACDev/AppData/Local/Temp/WindowsAETemp/35018_2225421_1655272247058 |
The bolded part should be extracted, as i already extracted by a regex command,
| rex "\"aeci\".*\"temp_path\":\s+\"(?<activity_id>[^\"]+)"
By the above command, I got the file path, In that i need the specifies bolded part,
Can anyone help in this, Provide the single regex command that should include above specified regex command, like, it should be from, aeci (used in above regex)
.
Does this work for you?
| rex "\"aeci\".*\"temp_path\":\s+\".*?\/(?<activity_id>[^\"\/]+)\""
Hi @ITWhisperer ,
Thanks for your response, It worked.
Does this work for you?
| rex "\"aeci\".*\"temp_path\":\s+\".*?\/(?<activity_id>[^\"\/]+)\""