extract part of path that may or may not contain space

[sarit_s]

Hello

i have source path that looks like :

s3://splunk/OTHER/1/OTHER/Star J750/pjserialnumber/2019-05-06T13:40:37.490Z_1.91.0.192_1.88.0.0_31.29.60.11592/metadata.json

i want to extract "pjserialnumber"
but since i have space in "Star j750"
my regex is not working

rex field=source \/splunk\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+)

my problem is that i want to create a macro from this regex but not all the path's contain space

how can i fix both of the problems ?

thanks

[gouravdashtcs]

Hello Sarit,

Kindly find the modified rex query for your reference.

rex field = source \/splunk\/\w+\/\w+\/\w+\/\w+\s+\w+\/(?\w+)

[lakshman239]

You can change it to something like \/splunk\/\w+\/\w+\/\w+\/(?<SerialNumber>[^\/]*)\/

https://regex101.com/r/lcAZF0/3

[sarit_s]

this is taking the wrong part of the path

[vnravikumar · Accepted solution]

Hi

Give a try

| makeresults 
| eval msg="s3://splunk/OTHER/1/OTHER/Star J750/pjserialnumber/2019-05-06T13:40:37.490Z_1.91.0.192_1.88.0.0_31.29.60.11592/metadata.json" 
| eval SerialNumber = mvindex(split(msg,"/") ,7)

[sarit_s]

work perfect !