Just tried with a small subset. Have a try using your dataset and let us know the results
index=_internal| stats count by source| rex field=source "\.(?<extn>[^\\\|^\/|^\.]+$)"| stats count by extn
so in your case, the actual search would be something like
<your search> | rex field=filePath "\.(?<extn>[^\\\|^\/|^\.]+$)"| stats count by extn
Just tried with a small subset. Have a try using your dataset and let us know the results
index=_internal| stats count by source| rex field=source "\.(?<extn>[^\\\|^\/|^\.]+$)"| stats count by extn
so in your case, the actual search would be something like
<your search> | rex field=filePath "\.(?<extn>[^\\\|^\/|^\.]+$)"| stats count by extn
that worked thanks a lot