How to print string in 7th column by reading csv cell value backwards using awk or sed

Question

I have 7th column with values like:

OS:J:\output\Windows\System32\winevt\Logs\Security.evtx
OS:J:\output\Windows\System32\winevt\Logs\System.evtx

I want to extract information by reading values backward and put in a new column.

Values to be extracted in a new column, lets say "location" should look like:

Location
Security.evtx
System.evtx

Answer 1

$ awk -F'\' '{print $7}' inputfile

Answer 2

As checked Last column is $7 Used below command to extract the values

command

sed -r 's/.*\\//g' filename

output

Security.evtx
System.evtx

Answer 3

Assuming there are at least six more fields that you don't show preceding the 7th field with the data in the question, you may read the CSV file with a tool such as Miller (mlr) to create a new location field for your new values.

Assuming further you have headers in your CSV file (since you want to create a new location field) and that the header for the 7th field is filepath, then you could do the following:

mlr --csv put '$location = sub($filepath,".*\\","")' file

The sub() function would remove all text before the last backslash in the filepath field. The result of that operation is then assigned to the new location field.

Testing:

$ cat file
A,B,C,D,E,F,filepath
1,2,3,4,5,6,OS:J:\output\Windows\System32\winevt\Logs\Security.evtx
1,2,3,4,5,6,OS:J:\output\Windows\System32\winevt\Logs\System.evtx

$ mlr --csv put '$location = sub($filepath,".*\\","")' file
A,B,C,D,E,F,filepath,location
1,2,3,4,5,6,OS:J:\output\Windows\System32\winevt\Logs\Security.evtx,Security.evtx
1,2,3,4,5,6,OS:J:\output\Windows\System32\winevt\Logs\System.evtx,System.evtx

$ mlr --c2p --barred put '$location = sub($filepath,".*\\","")' file
+---+---+---+---+---+---+---------------------------------------------------------+---------------+
| A | B | C | D | E | F | filepath                                                | location      |
+---+---+---+---+---+---+---------------------------------------------------------+---------------+
| 1 | 2 | 3 | 4 | 5 | 6 | OS:J:\output\Windows\System32\winevt\Logs\Security.evtx | Security.evtx |
| 1 | 2 | 3 | 4 | 5 | 6 | OS:J:\output\Windows\System32\winevt\Logs\System.evtx   | System.evtx   |
+---+---+---+---+---+---+---------------------------------------------------------+---------------+

Would you want to make the change in-place, then add the -I option before --csv on the command line.

Answer 4

awk -F ' / ' '{print $7} yourfilename