Try something like this | makeresults format=csv data="_time, username, computer, printer, source_dir, status
2024-09-24 15:32 , auser, cmp_auser, print01_main1, \\\\cpn...
See more...
Try something like this | makeresults format=csv data="_time, username, computer, printer, source_dir, status
2024-09-24 15:32 , auser, cmp_auser, print01_main1, \\\\cpn-fs.local\data\program\..., Printed
2024-09-24 13:57 , buser, cmp_buser, print01_offic1, c:\program files\documents\..., Printed
2024-09-24 12:13 , cuser, cmp_cuser, print01_offic2, \\\\cpn-fs.local\data\transfer\..., In queue
2024-09-24 09:26, buser, cmp_buser, print01_offic1, F:\transfers\program\..., Printed
2024-09-24 09:26, buser, cmp_buser, print01_front1, \\\\cpn-fs.local\transfer\program\..., Printed
2024-09-24 07:19, auser, cmp_auser, print01_main1, \\\\cpn-fs.local\data\program\...., In queue"
| rex field=source_dir "(?P<FolderPath>(\\\\\\\\|\w:\\\\)[^\\\\]+\\\\\w+)" btw, they are not really Linux paths as linux uses forward slashes "/"