How to regex match on back slash in character class?

[frbuser]

I am trying to use a regex to extract a PowerShell script that is being executed in a way that also includes the directory of the script.

Query
| rex field=Process_Command_Line "\w:(?<Script>[\\\w\\\\\s]+\.ps1)"

It's not working due to the way Splunk is processing the back slashes.

How do I match a literal back slash, a word character, and space within a character class in Splunk?

[frbuser · Accepted solution]

I think I figured it out:

| rex field=Process_Command_Line "(?<Script>\w:[-\w\s\\\]+\.ps1)"