topic Re: taking the source file path and creating a field in Getting Data In

taking the source file path and creating a field

sbattista09 — Tue, 16 May 2017 14:32:32 GMT

if i wanted to take the app_name from the path of the source and create a field via the CLI of the input how would i do that? I know i could rename the source type however, that is not a option. I want to create a new field based off the 4th position of the source path.

source = /foo/app/test/app/app_name/logs/log.log

Re: taking the source file path and creating a field

DalJeanis — Tue, 16 May 2017 14:41:42 GMT

use...

| rex field=source "^\/[^\/]+\/[^\/]+\/[^\/]+\/(?<myfield>[^\/]+)\/"

...or ...

| rex field=source "^\/[^\/]+\/[^\/]+\/[^\/]+\/[^\/]+\/(?<myfield>[^\/]+)\/"

...depending on whether your "fourth" was zero-based or one-based.

Re: taking the source file path and creating a field

sbattista09 — Tue, 16 May 2017 18:20:45 GMT

I don't want to do this via a inline search.

Re: taking the source file path and creating a field

rphillips_splk — Tue, 16 May 2017 18:55:55 GMT

You can setup in props.conf of the search head:

example with source stanza:

[source::/opt/log/*/logs]
EXTRACT-inSource = /opt/log/(?<field1>[^/]+)/logs/.* in source

example with sourcetype stanza:

[mysourcetype]
EXTRACT-inSource = /opt/log/(?<field1>[^/]+)/logs/.* in source

Re: taking the source file path and creating a field

woodcock — Tue, 16 May 2017 19:22:51 GMT

Like this:

 ... | rex field=source "^\/(?:[^\/]+\/){3}(?<app_name>[^\/]+)\/"

Re: taking the source file path and creating a field

DalJeanis — Tue, 16 May 2017 20:27:19 GMT

...then combine rphillips suggestion with either mine or woodcock's - use one of our rex codes, with rphillips' suggestion of where to do it.

Re: taking the source file path and creating a field

sbattista09 — Fri, 19 May 2017 19:28:10 GMT

This works well, one last question is, what is the syntax for extracting more fields in source?

putting in in like this only works with the foofoo extraction-
[sourcetypename]
EXTRACT-inSource = ^\/[^\/]+\/[^\/]+\/(?[^\/]+)\/ in source
EXTRACT-inSource = ^\/[^\/]+\/[^\/]+\/[^\/]+\/(?[^\/]+)\/ in source
EXTRACT-inSource = ^\/[^\/]+\/[^\/]+\/[^\/]+\/[^\/]+\/(?[^\/]+)\/ in source