topic Re: Validating the file name in splunk in Splunk Dev

Validating the file name in splunk

mahbs — Wed, 24 Jan 2018 09:58:45 GMT

Hi,

I was just wondering, is there a way to validate the name of the file that is being ingested into splunk?

So for example, if the file name is: "filename 20180124" I would have thought a regular expression could be used to validate that, but the question is, how do I use a query to display the file name into the console and then validate it?

Could someone shed some light on this?

Thanks

Re: Validating the file name in splunk

mayurr98 — Wed, 24 Jan 2018 10:02:51 GMT

are you looking for a list of file names that are been index by Splunk?

Re: Validating the file name in splunk

mahbs — Wed, 24 Jan 2018 10:04:43 GMT

Hey @mayurr98, not a list, but I've created dashboards per file. The Splunk picks up the file from the splunk server and ingests it. For that file that is being picked up, in that dashboard, I want to create a panel that basically checks to see if the file name conforms to the intended design

Re: Validating the file name in splunk

FrankVl — Wed, 24 Jan 2018 10:10:04 GMT

Is the filename in the source field (as usual)?

Then you could do something like:

...base search...
| eval validFileName=(if(match(source,"<validation regex>"),"Yes", "No"))