What regex to use to drop everything after the last occurrence of a symbol?

[jpfrancetic]

Hi Splunk Community,

I am working on a regex to filter the sources I am getting from logs. I am trying to drop everything after the last "/" in the field but I am having problems filtering.

My current sources look something like: /db2audit/fs01/db2inst1/extract/abc123/file.del

I am trying to filter it to look like: /db2audit/fs01/db2inst1/extract/abc123

Thanks in advance!

[gcusello]

Hi @jpfrancetic,

if the first part is fixed in the first four folders, you could extract something like this:

| rex field=source "^(?<path>(\/\w+){4}).*(?<filename>\/\w+\.\w+$)"

that you can test at https://regex101.com/r/j7XgJ5/1

Ciao.

Giuseppe

[richgalloway · Accepted solution]

Try this command.

| rex mode=sed field=foo "s/(.*)\/.*?$/\1/"

[gcusello]

Hi @jpfrancetic,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉