topic Re: Can you help me with my regular expression extraction? in Splunk Search

Can you help me with my regular expression extraction?

swetar — Fri, 12 Oct 2018 02:09:09 GMT

Can anyone please suggest to me how I can break this event...

PATH="/user/hive/datastore/xyz.db/file_name1"
PATH="/user/hive/datastore/xyz.db/file_name2"
PATH="/user/hive/datastore/xyz.db/file_name3"

Into this required output:

required output 
file_name1
file_name2
file_name3

Thanks in advance
swetar

Re: Can you help me with my regular expression extraction?

Rob2520 — Fri, 12 Oct 2018 02:40:58 GMT

Re: Can you help me with my regular expression extraction?

adonio — Fri, 12 Oct 2018 02:52:46 GMT

hello there,

try this search anywhere:

  | makeresults count=1
    | eval  PATH="\"/user/hive/datastore/xyz.db/file_name1\";\"/user/hive/datastore/xyz.db/file_name2\";\"/user/hive/datastore/xyz.db/file_name3\""
    | makemv PATH delim=";"
    | mvexpand PATH
    | table PATH
    | rename COMMENT as "above generates data, below is your solution"
    | rex field=PATH "\"\/(?<dir_1>[^\/]+)\/(?<dir_2>[^\/]+)\/(?<dir_3>[^\/]+)\/(?<dir_4>[^\/]+)\/(?<file_name>[^\"]+)"

screenshot:

Re: Can you help me with my regular expression extraction?

swetar — Mon, 15 Oct 2018 09:24:48 GMT

Thank you for your reply . I tried in this way. But didn't worked. Can you please suggest me,where I am wrong .
sourcetype="XXXXXX"| mvexpand PATH
| table PATH
| rex field=PATH "\"\/(?[^\/]+)\/(?[^\/]+)\/(?[^\/]+)\/(?[^\/]+)\/(?[^\"]+)"

Re: Can you help me with my regular expression extraction?

swetar — Mon, 15 Oct 2018 09:27:00 GMT

Thank you for your reply . I tried this way but didn't work. I am new to regular expression. Can you please suggest me with complete syntax.

Many thanks
Swetar

Re: Can you help me with my regular expression extraction?

swetar — Tue, 16 Oct 2018 06:38:16 GMT

Thank you for your reply. I was able to do this ,using the below expression

"\/(?[^\/]+)$"

Many thanks

Re: Can you help me with my regular expression extraction?

swetar — Tue, 16 Oct 2018 06:38:22 GMT

Thank you for your reply. I was able to to do this ,using the below expression

"\/(?[^\/]+)$"