topic How do i extract data from my event source filename in Getting Data In

How do i extract data from my event source filename

pradiptam — Tue, 29 Sep 2020 18:02:22 GMT

I have multiple logfiles like TEST_SRC_FR.txt, TEST_SRC_IN.txt, TEST_SRC_AU.txt which are my source files. Now i want to extract the last two letters like "FR" from TEST_SRC_FR.txt.

Any idea how to get them during search time.

Regards,

Pradipta

Re: How do i extract data from my event source filename

493669 — Thu, 08 Feb 2018 19:02:12 GMT

try this run anywhere search:

| makeresults |eval _raw="TEST_SRC_FR.txt"|rex ".*_(?<name>\w{2})"

in your case you can use as

index=<indexname>| rex field=source ".*_(?<name>\w{2})"

also you can make this regex in props.conf

Re: How do i extract data from my event source filename

Richfez — Thu, 08 Feb 2018 19:04:21 GMT

Sure!

... | rex field=source "(?<LastTwoLetters>..)\.txt$"

That assume they're the literal field source and that they ALWAYS end with "txt".

Modifications can be made for other similar scenarios, but you'll have to be very specific in describing them. 🙂

Happy Splunking,
Rich

Re: How do i extract data from my event source filename

pradiptam — Fri, 09 Feb 2018 05:53:52 GMT

Great its working fine for me.

regards,
Pradipta

Re: How do i extract data from my event source filename

pradiptam — Fri, 09 Feb 2018 05:54:43 GMT

Thanks its also working, checking which one to use in my program

Regards,
Pradipta