topic Re: source name setup with wildcard in Getting Data In

source name setup with wildcard

SS1 — Thu, 11 Mar 2021 03:58:41 GMT

Hi Everyone,

Currently i am monitoring the *.log files under a path, i have not given a source name since we dont have a definite source The file names keep on updating

My Inputs.conf

[monitor://[path]\*.log]
disabled = 0
index = test
sourcetype = sourcetypetest

When the data is indexed into splunk, it is giving the source names as "E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log'' where as i just want to extract the 'user-MemoCPU' field in the source and display in a dashboard panel. Please let me know if its possible

I am building a dashboard panel with below query,

index = test | stats count by source | sort -count

Re: source name setup with wildcard

manjunathmeti — Thu, 11 Mar 2021 06:40:03 GMT

You can use rex to extract the only filename:

index = test | rex field=source "(?<source>[^\\\\]+)\.log$" | stats count by source | sort -count

If this reply helps you, an upvote/like would be appreciated.

Re: source name setup with wildcard

SS1 — Thu, 11 Mar 2021 06:47:14 GMT

Thanks, this worked like a charm.

output is shown as below

source count

user-MemoCPU 1

Is there a way i can show output as just like below

source count

user 1

source issue

user MemoCPU

Re: source name setup with wildcard

manjunathmeti — Thu, 11 Mar 2021 06:56:14 GMT

Yes,
For the first one just extract the user part:

index = test | rex field=source "\\\\(?<source>\w+)-\w+.log$" | stats count by source | sort -count

For the second one:

index = test | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | table source, issue

If this reply helps you, an upvote/like would be appreciated.

Re: source name setup with wildcard

SS1 — Thu, 11 Mar 2021 06:58:58 GMT

Thanks a lot, both working fine !

Re: source name setup with wildcard

manjunathmeti — Thu, 11 Mar 2021 07:03:01 GMT

You are welcome! Upvotes will be appreciated!