https://community.splunk.com/t5/Getting-Data-In/splunk-rename-source/m-p/543315#M90713 <P>You can extract using rex command:</P><LI-CODE lang="markup">| makeresults | eval source="E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log" | rex field=source "(?&lt;source&gt;[^\\\\]+)\.log$"</LI-CODE><P>&nbsp;</P><P>If this reply helps you, an upvote/like would be appreciated.</P> Thu, 11 Mar 2021 06:41:30 GMT manjunathmeti 2021-03-11T06:41:30Z https://community.splunk.com/t5/Getting-Data-In/splunk-rename-source/m-p/543298#M90711 <P>I have my source name as&nbsp;below, the 'user' field keeps on updating</P><P><SPAN>E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log</SPAN></P><P>I don't want to display the entire path but just want user-MemoCPU as source, can we achieve it?</P> Thu, 11 Mar 2021 04:41:57 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-rename-source/m-p/543298#M90711 SS1 2021-03-11T04:41:57Z https://community.splunk.com/t5/Getting-Data-In/splunk-rename-source/m-p/543315#M90713 <P>You can extract using rex command:</P><LI-CODE lang="markup">| makeresults | eval source="E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log" | rex field=source "(?&lt;source&gt;[^\\\\]+)\.log$"</LI-CODE><P>&nbsp;</P><P>If this reply helps you, an upvote/like would be appreciated.</P> Thu, 11 Mar 2021 06:41:30 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-rename-source/m-p/543315#M90713 manjunathmeti 2021-03-11T06:41:30Z