I'm attempting to determine what folders on a Windows server are being audited. I don't have access to the server to view the inputs.conf file and need to discover what folders are being accessed from the audit logs sent to Splunk. The field labeled FilePath shows the entire path to the file. I have not been successful in creating a regex query to extract only the top parent folder. Because the string value of FilePath contains the full path, I am trying to figure out how to display just the first folder of the entire folder path. index=win_servers Computer="Storage" | table FilePath | rex field=FilePath "^\\ (?<FilePath>[^\\ ]+)" The search above produces the results below after passing it to dedup. H:\Folder1\subfolder1\subfolder_A H:\Folder1\subfolder1\subfolder_B H:\Folder1\subfolder2\subfolder_A H:\Folder2\subfolder1\ H:\Folder2\subfolder2\subfolder_A H:\Folder2\subfolder3\subfolder_B H:\Folder3\subfolder1\ H:\Folder3\subfolder2\ H:\Folder4\subfolder1\ H:\Folder4\subfolder2\ The results I am looking for is to just show the following: H:\Folder1\ H:\Folder2\ H:\Folder3\ H:\Folder4\ ... I've looked at the following posts and haven't been able to successfully apply what is mentioned to my situation. https://community.splunk.com/t5/Splunk-Search/rex-regex-to-extract-first-folder-name-from-the-path/m-p/287508 https://community.splunk.com/t5/Splunk-Search/Regex-Source-and-Destination-files-with-path-filename-extension/m-p/271989 https://community.splunk.com/t5/Splunk-Search/Regex-to-match-string-between-2-strings/m-p/626758#M217834 Any help would be appreciated! ... View more