Right now Im using
rex field=cs_uri_path "^.*\/(?[^.\/]+.(?:[^.\/]){3,4})$"
but im missing files like blah.1.0.8file.exe
and double extensions like .pdf.exe
I cant seem to adjust to pick out these exceptions
Try this
... | rex (?<cs_uri_path>\S+)(?<=\.exe)
Try this:
... | rex field=cs_uri_path "(?ms)(?<filename>[^\\\/\r\n\s]+)[\r\n$]"
Also try this app:
That one wont work.
This is what I am using and it works fine i just need to have it be able to pick up files that may have "." in there names like blah1.0.8update.exe
"^.*\/(?[^.\/]+.(?:[^.\/]){3,4})$"
Why won't it work? Your seems tediously overcomplicated. Give me the exception where the simpler one fails.