title: Kusto query to get the file extension from the message log using regex
body: <p>I am trying to get the file extension from the Kusto message log. Below is how my log looks:</p>
  <pre class="lang-txt prettyprint-override"><code>&quot;Symchk result for D:\pkgshadow\19H1\999907\files.csi\arm64\neutral\fre\Microsoft-OneCore-VirtualizationBasedSecurity-Package~31bf3856ad364e35~amd64~~10.0.21380.1020.mum is NOTAPPLICABLE&quot;
  </code></pre>
  <p>I wanted to get the extension &quot;<strong>mum</strong>&quot; from the above log.</p>
  <p>Below is the query I have tried but it is not working.</p>
  <pre><code>| extend filepath = trim_start(&quot;Symchk result for &quot;, trim_end(&quot; is NOTAPPLICABLE&quot;, ParsedMsg))
  | extend extension = extract(**@&quot;([^\\]*\.\w+\s)&quot;**, 1, filePath)
  | project extension
  </code></pre>
  <p>I am getting the file (i.e. <strong>Microsoft-OneCore-VirtualizationBasedSecurity-Package~31bf3856ad364e35~amd64~~10.0.21380.1020.mum</strong>) as an output using the above regex. I wanted to get the extension of file (i.e. <strong>mum</strong>).
  Can someone help me with this?</p>