topic Re: Extract filename from source in Getting Data In

Extract filename from source

vincenty — Fri, 12 Apr 2013 21:05:40 GMT

I am trying do a search for all exceptions and list the associated filename instead of the whole path+filename in my results table.

I tried the following in my search but it didn't work:
Exception sourcetype=qagadc1 | rex ".?(?(?:\w+.)+\w?Exception)." | rex field=source "(?(/\w)+)/+(?\w+)+.*" |table source fname

my source structure is not unique, they are varies as follow:
/home/d1/d2/d3/fn1.log
/home/d1/d2/d3/d4/d5/fn2.out
/home/d1/d2/d3/d4/d5/d6/fn3.log

...

please help.

Re: Extract filename from source

martin_mueller — Fri, 12 Apr 2013 21:15:38 GMT

To extract the last segment of a path from a field you can append this to your search:

 | eval field = replace(field, ".*/", "")

Edit: If you want the last bit after the final dot you can modify the expression like this:

  | eval field = replace(field, ".*\.", "")

Re: Extract filename from source

vincenty — Fri, 12 Apr 2013 21:48:49 GMT

actually, I am trying to get the filename extension (i.e fn2.out, fn3.log) as part of the "fname" returned.

Tried appending what you suggested still does not give me fn3.log, or fn2.out etc.

Re: Extract filename from source

vincenty — Fri, 12 Apr 2013 21:49:05 GMT

actually, I am trying to get the filename extension (i.e fn2.out, fn3.log) as part of the "fname" returned.

Tried appending what you suggested still does not give me fn3.log, or fn2.out etc.

Re: Extract filename from source

vincenty — Fri, 12 Apr 2013 21:49:31 GMT

actually, I am trying to get the filename extension (i.e fn2.out, fn3.log) as part of the "fname" returned.

Tried appending what you suggested still does not give me fn3.log, or fn2.out etc.

Re: Extract filename from source

martin_mueller — Fri, 12 Apr 2013 21:51:17 GMT

That's just a matter of modifying the expression, see my edited answer.

Re: Extract filename from source

koshyk — Mon, 21 Aug 2017 10:01:51 GMT

In case if your filename contains a . then

# For Unix style
| rex field=<fieldname> "/(?<newField>[\w\d\.]+$)"