topic Re: Get the length of a file name before the extension in Dashboards & Visualizations

Get the length of a file name before the extension

landen99 — Wed, 12 Mar 2014 20:13:32 GMT

I searched this one quite a bit because the solution seemed like it would be really easy.

Given the filename field has only a name.extension, I want to count the length of the name, which is 4 in this case.

In Excel, I would just do =len(left(A2,Find(“.“,A2))), I believe. Seems really easy.

Examples:
a.txt 1
bee.bat 3
ce.command 2

Re: Get the length of a file name before the extension

martin_mueller — Wed, 12 Mar 2014 20:41:16 GMT

Take a look at this:

| stats count | eval file="a.txt bee.bat ce.command" | makemv file | mvexpand file | eval count = length(replace(file, "\.[^.]+$", ""))

That creates a field file with your examples, and computes a field count that matches your results - that's the eval at the end, same strategy as your Excel computation.

Re: Get the length of a file name before the extension

landen99 — Thu, 13 Mar 2014 12:41:27 GMT

Your answer helped me to build the search below for good results:

| eval file_length=length(replace(filename, "\.[^.]+$", ""))

Does your search produce the same results or something different than the search above?
Also, why do you invoke stats count and count in eval?

Here are a few of the regex suggestions I have read:

([^\.]*)
/^(.+)(\.[^ .]+)?$/
\.[^.]*$
(.+?)(\.[^.]*$|$)
(.+?)\.[^\.]+$
(.+?)(\.[^\.]+$|$)
^(.*)\..*$

Learning regex atm.
-What is the difference between your regex and ^(.*)\..*$? They seem to do the same thing as well.

Re: Get the length of a file name before the extension

martin_mueller — Thu, 13 Mar 2014 12:47:16 GMT

I start the search with | stats count to get an empty event to work with, no need for data from any index. The first eval | makemv | mvexpand builds simulation data, the eval at the end is the part you need for your search... it might look something like this:

index=foo sourcetype=bar filename=* | eval filename_length = length(replace(filename, "\.[^.]+$", ""))

Your regexes are hard to read, Splunk Answers treats backslashes, asterisks, and underscores within regular text as special characters. Prepend four spaces to your regexes to avoid that.

Re: Get the length of a file name before the extension

martin_mueller — Thu, 13 Mar 2014 12:49:42 GMT

My regex works like this, from right to left:

Anchor to the end of the field
Match one or more characters that are not a literal dot
Match one literal dot

Then that match is removed from the string by the replace, so the length only counts the filename without the extension. Some examples, with parentheses denoting the matched and removed part:

file(.name) --> length is 4
some.other.file(.name) --> length is 14
(.hidden) --> length is 0

Re: Get the length of a file name before the extension

landen99 — Thu, 13 Mar 2014 12:49:49 GMT

The actual excel code would really be: =LEN(LEFT(A1,FIND(".",A1,1)-1))

Re: Get the length of a file name before the extension

landen99 — Thu, 13 Mar 2014 13:00:59 GMT

I added 4 spaces before each regex expression. Is that what you were after?

I wish this site was easier to post to. I have a lot of difficulty with the captcha working and there are no tools for inserting html codes like spoiler, code, image, etc to the post.

Re: Get the length of a file name before the extension

martin_mueller — Thu, 13 Mar 2014 13:04:30 GMT

I have edited the comment, the four-spaces-block needs an empty line before it to work properly. Now asterisks and all that are rendered correctly. For posting code blocks inline surround it by backticks (`).

Re: Get the length of a file name before the extension

martin_mueller — Thu, 13 Mar 2014 13:07:07 GMT

As for your question "-What is the difference between your regex and ^(.*)\..*$? They seem to do the same thing as well.", yours looks for the first literal dot while mine looks for the last literal dot. An example:

some.other.file(.name) --> my regex will match only the .name, length is 14
some(.other.file.name) --> your regex will match the entire string, and when replaced with $1 the remaining length will be 4

Re: Get the length of a file name before the extension

landen99 — Thu, 13 Mar 2014 13:23:52 GMT

Perfect. Thank you very much for your insight and guidance here.