I am ingesting McAfee ePO logs from several endpoints.
We have an eval command that works pretty well by coalescing all the file paths into this 1 eval command.
EVAL-file_path = coalesce(file_path1,filepath2,filepath_3)
Each of these file paths end up looking something like:
\Path\to\file\filename.exe
\Path\to\file\filename.log
I wanted to try and extract that "filename.exe" by itself and give it its own field.
rex field=file_path "(?<filename>[^\\]*)$"
That should extract the last segment (i.e., the filename) from the file path
We're trying to make this a field via a search time extraction. If I could somehow grab that rex command and throw it into an eval, that would be great, but looking over the EVAL documentation, it doesnt look like thats supported.
You dont need to put it into an eval
. If you use | rex ... |
, the filename
is a field that is created