Regex help

[SS1]

Hi,

I have below sources,

source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log

source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log

Instead of displaying full paths i want the source to display just, can we have a rex for this one

source = user1

source = user2

source = user3

source = user4

[SS1]

Yes, this working now. Thanks @kamlesh_vaghela @gcusello 

[SS1]

No, this was regex was unable to extract the user field

[gcusello]

Hi  @SS1,

the solution of @kamlesh_vaghela  is running on my Splunk.

Eventually, you could try something near:

| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"

to test in this way:

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"
| table source user

Ciao.

Giuseppe

[kamlesh_vaghela · Accepted solution]

@SS1 

Can you please try this?

YOUR_SEARCH 
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

My Sample Search :

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.