field extraction

[Nadhiya_Dubai]

/data/scripts/esx/outfile/dc1-ch1-esxi05.dca.com-vmnic0.txt

I need to extract the dc1-ch1-esxi05.dca.com-vmnic0 from the above string . How can i write regex for this .

[vnravikumar]

Hi

Give a try

| makeresults 
| eval path="/data/scripts/esx/outfile/dc1-ch1-esxi05.dca.com-vmnic0.txt" 
| rex field=path "(?P<temp>.*(?=\.))" 
| rex field=temp "(?P<output>[^\/]+$)"

[gf13579 · Accepted solution]

(?<server_and_interface>[^\/]+)\.txt$

Here it is in action:

| makeresults | eval source="/data/scripts/esx/outfile/dc1-ch1-esxi05.dca.com-vmnic0.txt" | rex field=source "(?<server_and_interface>[^\/]+)\.txt$"

[Nadhiya_Dubai]

It worked . Thanks