KQL Regex Extraction

Question

I'm trying to pull out a file name and it's extension when it's part of a file path, here's the regex I'm using:

([^\\]*\.\w+)

Here's an example file path I've tested using regex101:

c:\\users\\u10061279\\appdata\\local\\temp\\2cert_desktop.xml

This works fine when I'm testing using regex101 etc. but when I try and put this into a query as per the below: ExtractQuery

The syntax looks messed up and when I hover over the query it says it's missing '"' QueryError

I'm unsure how I can get this to work, I've been playing about with it for a while and can't get the errors to clear. Thanks in advance!

Try double escaping the backslashes – The fourth bird Jun 23 '20 at 12:20 — The fourth bird, Jun 23 '20 at 12:20

score 1 · Answer 1 · answered Jun 23 '20 at 13:37

You can use '@' prefix to a string literal (similar to .NET).

print m="c:\\users\\u10061279\\appdata\\local\\temp\\2cert_desktop.xml"
| project extract(@"([^\\]*\.\w+)", 1, m)

1 Answers1