Splunk Search

Using regex to filter by file directory

nwalker15
Engager

I have a field in splunk named commandline.  I want to filter this field just by values containing "C:\"

This appears sometimes at the beginning of the filed value and other times in the middle.  Can someone help me with a regex statement or other search filter to narrow my results this way?

Labels (1)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Use wildcards

commandline=“*C:\*”

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

Vardhan
Contributor

Hi @nwalker15 ,

 provide sample logs and highlight the keyword which you want to extract.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Use wildcards

commandline=“*C:\*”

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...