What is the regular expression to extract substring from a string?

[rakeshcse2]

My log source location is : C:\logs\public\test\appname\test.log

I need a regular expression to just extract "appname" from the source location in my search output and then display that as a new column name.

[mpreddy]

try this:

|stats c |eval _raw="C:\logs\public\test\appname\test.log"|rex field=_raw "\w+.\w+.\w+.(?<appname>\w+)"

[rakeshcse2]

Thank you very much, that worked.

[somesoni2 · Accepted solution]

Give this a try

Updated

your current search giving field source which contains full file path
| rex field=source "^([^\\\\]+\\\\)+(?<AppName>[^\\\\]+)\\\\"

Runanywhere sample:

| gentimes start=-1 | eval source="C:\logs\public\test\appname\test.log" | table source | rex field=source "^([^\\\\]+\\\\)+(?<AppName>[^\\\\]+)\\\\"

[rakeshcse2]

Thank you, but the appname is not constant and it is different for different application.
I need to extract any xyz appname from the source location.

[somesoni2]

It's capturing whatever string comes as the immediate parent to file name. The 2nd is just an example search to test it.

[rakeshcse2]

I am using this and its not working:

source=* "error" host="*" | chart count by source | rex field=source "^([^\]+\)+(?[^\]+)\\"

[somesoni2]

Try with the updated string (needed one additional backslash, 4 at a time)

[rakeshcse2]

Sorry, i deleted my last post , that was not clear.

The thing is we just need to change teh regex to include one more / in the source path, that is :

C:\logs\public\test\appname\abcd\test.log
From the top i need to extract appname only.

[somesoni2]

You need to fix a position for the app name (earliest we assumed it was the last folder before the file name). So can we say it's always the 5th segment from start? If yes, then try this

....| rex field=source "^([^\\\\]+\\\\){4}(?<AppName>[^\\\\]+)\\\\"