Splunk Search

How to rex a uri path in order to get a filename with certian extensions lik .pdf .exe .zip

alexburst37
Explorer

Right now Im using

rex field=cs_uri_path "^.*\/(?[^.\/]+.(?:[^.\/]){3,4})$"

but im missing files like blah.1.0.8file.exe
and double extensions like .pdf.exe

I cant seem to adjust to pick out these exceptions

1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try this

... | rex (?<cs_uri_path>\S+)(?<=\.exe)

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

... | rex (?<cs_uri_path>\S+)(?<=\.exe)

0 Karma

woodcock
Esteemed Legend

Try this:

... | rex field=cs_uri_path "(?ms)(?<filename>[^\\\/\r\n\s]+)[\r\n$]"

Also try this app:

https://splunkbase.splunk.com/app/2734/

0 Karma

alexburst37
Explorer

That one wont work.
This is what I am using and it works fine i just need to have it be able to pick up files that may have "." in there names like blah1.0.8update.exe

"^.*\/(?[^.\/]+.(?:[^.\/]){3,4})$"

0 Karma

woodcock
Esteemed Legend

Why won't it work? Your seems tediously overcomplicated. Give me the exception where the simpler one fails.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...