Splunk Search

How to remove Windows subfolders from search results by using regular expression?

erictodor
New Member

I have a search which produces c:\folder\folder\folder\folder\file.exe as results. I want to remove all of the c:\folders so I'm only left with file.exe. Its unknown how many subfolders may exist in my search. I'm still new to regex searching so I managed to get the query I want in a simulator but I can't get splunk to produce the results.

Expression [^\\\]*$

| rex field=Filepath "(?<'Path'>[^\\\]*$)" 

Any help would be appreciated

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try (run anywhere sample, replace line 1 with your search)

| gentimes start=-1 | eval FilePath="c:\folder\folder\folder\folder\file.exe" | table FilePath 
| rex field=FilePath "\\\(?<path>\w+\.\w+)$"

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try (run anywhere sample, replace line 1 with your search)

| gentimes start=-1 | eval FilePath="c:\folder\folder\folder\folder\file.exe" | table FilePath 
| rex field=FilePath "\\\(?<path>\w+\.\w+)$"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...