How to write the regex to remove the filename and only return the path from my data?

[kleckns]

I'm trying to remove the filename from path and return path only in Splunk

example:

`C:\path\path\path\path\application.exe`

the path is variable length.

`| regex mypath="[^.*\/].*" |`

not only does my syntax for the command between splunk pipes not work, but the syntax for regex argument is incorrect as well. any help appreciated.

[judevine]

You probably already have your solution in 2021, but anyway, here's a solution:

| makeresults
| eval path="/opt/splunk/etc/system/local/inputs.conf"
| eval base_path=replace(path,"\/[^\/]+\.[^\/]+$","")
| table path base_path

[somesoni2 · Accepted solution]

Give this a try

| rex field=yourfieldname  "(?<Path>.*)\\\\"

See this runanywhere splunk search

| gentimes start=-1 | eval path="C:\path\path\path\path\application.exe" | table path | rex field=path "(?<Path>.*)\\\\"

[kleckns]

That worked. Thank you very much.