Regex question

[gnovak]

I can't seem to figure this one out. I have a line in a log like this:

2012-08-07 12:35:49,138 [http-10.40.231.33-40081-11] INFO info.mycompany.WAT.report.ReportService - USER [6913-ZZ] downloading /billing/2012/May/Statement.pdf

And here is my splunk search with regex:

sourcetype="EPPWEB" source="/opt/log//web_server/info.log" WAT | rex field=_raw "USER (?P[\d+-\w\w]) downloading /[^/]+/[^/]+/(?P\w.\w+)+$"

For the field "filename" i have results like ".pdf" or ".txt". I'd like to get the entire file name ....Statement.pdf

What am I missing or not missing?

[dmaislin_splunk · Accepted solution]

rex field=_raw "USER.*/(?.+?)$"

[dmaislin_splunk]

Awesomeness!

[gnovak]

This actually worked. I took some of your example and added it. sourcetype="EPPWEB" source="/opt/log//web_server/info.log" WAT | rex field=_raw "USER (?P[\d+-\w\w])./(?.+?)$"

Thanks for the help

[gnovak]

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT | rex field=_raw "USER (?P[\d+-\w\w]) downloading /[^/]+/[^/]+/(?Pw+.w+).$" doesn't work. Even taking away the $ doesn't work either. 😞

[christopher_hod]

Try making the end look like this:
downloading /[^/]+/[^/]+/(?P[\w.])$"

[gnovak]

When I take the ending + away the field "filename" isn't extracted any more.

[sdaniels]

Maybe (?Pw+\.w+). Escape the period just to make sure.