Ok, I think I've got a solution: [search] | rex field=data "504B.{56}(?<target>.{2,100}2E.{6})" | [previous urldecode solution] That should handle detecting any path/filename.ext up to 50+3.    It will still fail to detect files without an extension, but I'm at least at a 90% solution ... View more