Splunk Search

How to rex a uri path in order to get a filename with certian extensions lik .pdf .exe .zip

alexburst37
Explorer

Right now Im using

rex field=cs_uri_path "^.*\/(?[^.\/]+.(?:[^.\/]){3,4})$"

but im missing files like blah.1.0.8file.exe
and double extensions like .pdf.exe

I cant seem to adjust to pick out these exceptions

1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try this

... | rex (?<cs_uri_path>\S+)(?<=\.exe)

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

... | rex (?<cs_uri_path>\S+)(?<=\.exe)

0 Karma

woodcock
Esteemed Legend

Try this:

... | rex field=cs_uri_path "(?ms)(?<filename>[^\\\/\r\n\s]+)[\r\n$]"

Also try this app:

https://splunkbase.splunk.com/app/2734/

0 Karma

alexburst37
Explorer

That one wont work.
This is what I am using and it works fine i just need to have it be able to pick up files that may have "." in there names like blah1.0.8update.exe

"^.*\/(?[^.\/]+.(?:[^.\/]){3,4})$"

0 Karma

woodcock
Esteemed Legend

Why won't it work? Your seems tediously overcomplicated. Give me the exception where the simpler one fails.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...