I am trying to use regular expression for extracting the Filename filed in Splunk,I have attached the same text

Question

ID=6913&Filename=C%3A%5CUsers%5CTHanse04%5CAppData%5CRoaming%5CDocumentum%5CViewed%5C181019_ERS_321_102_500857.pdf&Download=65536&DownloadSize=79243 HTTP/1.1" 200 3 "-" "Java/1.8.0_192"

I need to extract and after extract i need Thanse04 from it Filename=C%3A%5CUsers%5CTHanse04%5CAppData%5CRoaming%5CDocumentum%5CViewed%5C181019_ERS_321_102_500857.pdf

score 0 · Accepted Answer · answered Feb 17 '20 at 17:04

0

(?:Filename=)(.*)(.pdf)(?:&)

demo

Explanation: (?:) is a matching but not capturing group. Here it matches 'Filename= but does not capture it. The regex keeps on capturing until it captures .pdf and then makes sure that the next character after that is & which it also matches but does not capture.

answered Feb 17 '20 at 17:04

Barka

8,234
12
57
88

@Anshuman your welcome. Please accept the answer. That way others will not try to answer an answered question. Thanks! https://stackoverflow.com/help/someone-answers – Barka Feb 19 '20 at 14:07

score 0 · Answer 2 · answered Feb 17 '20 at 18:59

0

Try Filename=%3A%5CUsers%5C(?<user>[^%]+).

answered Feb 17 '20 at 18:59

RichG

4,202
1
12
23

I am trying to use regular expression for extracting the Filename filed in Splunk,I have attached the same text

2 Answers2