Try this
| rex field=source "(?<path>.*)[//\\\]+.[a-zA-Z.]*"
@rahulroy_splunk: this is what i was searching for. thank you! thank you somesoni2 for your help.
This will also work.
| rex field=source "(?
I am still not clear with the requirement. Would it be possible for your provide example. like for "C:\test\test9\some9sample.log", result should be "C:\test\test9"
my backslashes were deleted..
i'd like to accept in the filename all characters except the backslash. so i thougt for something like [\\][^\\]*
for the last part. (i dont really understand [//\\\]
.)
Could you be little more specific? probably an example?
Thank you.
A little bit better version is:
rex field=source "(?
How is it possible to find all characters except \ in the latter part?