;1;1;;;File not found : D:\WINDOP\COMS\WINDOP\IN\UPDATE.TXT
;3;1;;;File not found : D:\WINDOP\COMS\WINDOP\IN\STORE.TXT
;1;0;0;;D:\WINDOP\COMS\WINSDOP\IN\PROD.TXT
;1;0;2;;D:\WINDOP\COMS\WINSDOP\IN\MTPRO.TXT
;0;3;0;;D:\WINDOP\COMS\GARIA\IN\1449\CARDDOLD.TXT
Try the following rex command for field extraction. You can use regex101.com for testing regular expression with your sample data:
<yourBaseSearch>
| rex "(?<fqdnFile>\w\:[^\.]+\.TXT)$"
Following is the run anywhere example base d on sample data provided (commands from makeresults till rename are used to generate sample data):
| makeresults
| eval data=";1;1;;;File not found : D:\WINDOP\COMS\WINDOP\IN\UPDATE.TXT|;3;1;;;File not found : D:\WINDOP\COMS\WINDOP\IN\STORE.TXT|;1;0;0;;D:\WINDOP\COMS\WINSDOP\IN\PROD.TXT|;1;0;2;;D:\WINDOP\COMS\WINSDOP\IN\MTPRO.TXT|;0;3;0;;D:\WINDOP\COMS\GARIA\IN\1449\CARDDOLD.TXT"
| makemv data delim="|"
| mvexpand data
| rename data as _raw
| rex "(?<fqdnFile>\w\:[^\.]+\.TXT)$"