The below is the text we are capturing Filename=
&Filename=C%3A%5CUsers%5Cjbaile16%5CAppData%5CRoaming%5CDocumentum%5CViewed%5CSlip+End+3_Quote_AVNAN1900010_Kofax_LMPR_PL_2563798.pdf&Download=0&DownloadSize=144780 HTTP/1.1" 200 3 "-" "Java/1.8.0_192"
We used Regex: rex field=_raw "U(?\S{1,}.[gf])"
we are able to extract Users%5Cjbaile16%5CAppData%5CRoaming%5CDocumentum%5CViewed%5CSlip+End+3_Quote_AVNAN1900010_Kofax_LMPR_PL_2563798.pdf
but now we want to remove %5C from the extracted text and get the remaining text with a space instead
| makeresults
| eval _raw="&Filename=C%3A%5CUsers%5Cjbaile16%5CAppData%5CRoaming%5CDocumentum%5CViewed%5CSlip+End+3_Quote_AVNAN1900010_Kofax_LMPR_PL_2563798.pdf&Download=0&DownloadSize=144780 HTTP/1.1\" 200 3 \"-\" \"Java/1.8.0_192\""
| rex "Filename=(?<filepath>.*?)&"
| eval filepath=urldecode(filepath)
| eval Filename=mvindex(split(filepath,"\\"),-1)
| table filepath Filename
try urldecode
how about my REGEX?
@1200125 Your rex command didn't work for me, but was close. Here's a run anywhere example, where I use the rex
command and define a capture group. Then eval
that capture group to replace
the sequence.
| noop
| stats count
| eval _raw="Filename=&Filename=C%3A%5CUsers%5Cjbaile16%5CAppData%5CRoaming%5CDocumentum%5CViewed%5CSlip+End+3_Quote_AVNAN1900010_Kofax_LMPR_PL_2563798.pdf&Download=0&DownloadSize=144780 HTTP/1.1\" 200 3 \"-\" \"Java/1.8.0_192\""
| rex field=_raw "(?<mycapturegroup>U\S{1,}.[gf])"
| eval mycapturegroup = replace(mycapturegroup, "%5C", " ")
To replace %5C with " " use rex on Filename:
| rex field=Filename mode=sed "s/%5C/ /g"