https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473490#M133216 <P>I have the following search set up:</P> <P><EM>search string</EM><BR /> | fields host <EM>raw <BR /> | fields - _time _indextime _sourcetype _subsecond _serial _bkt _cd _si _kv _timediff | head 1 <BR /> | join append [ stats count | fields - count ]<BR /> | eval SourcePath=<STRONG><EM>WHAT TO PUT HERE?</EM></STRONG><BR /> | eval ConfigItem="Config Item" <BR /> | eval PAGER="Pager" <BR /> | eval TEAM="Team"<BR /><BR /> | eval GROUP="Group" <BR /> | eval SHORTDESCRIPTION="Short Description"<BR /> | table host _raw SourcePath Config.Item PAGER TEAM GROUP SHORTDESCRIPTION<BR /> | rex mode=sed "s/\,//g"<BR /> | rex mode=sed "s/[^a-zA-Z0-9</EM>-.]+/ /g"<BR /> | outputcsv file.csv</P> <P>Everything is working as required, I am just not too sure what should I match <STRONG><EM>eval SourcePath=</EM></STRONG> with in order to obtain the string of the source log file's path?<BR /> Anyone able to assist?</P> <P>Thanks a bunch!<BR /> Tom</P> Thu, 16 Apr 2020 15:18:23 GMT tom1981 2020-04-16T15:18:23Z https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473490#M133216 <P>I have the following search set up:</P> <P><EM>search string</EM><BR /> | fields host <EM>raw <BR /> | fields - _time _indextime _sourcetype _subsecond _serial _bkt _cd _si _kv _timediff | head 1 <BR /> | join append [ stats count | fields - count ]<BR /> | eval SourcePath=<STRONG><EM>WHAT TO PUT HERE?</EM></STRONG><BR /> | eval ConfigItem="Config Item" <BR /> | eval PAGER="Pager" <BR /> | eval TEAM="Team"<BR /><BR /> | eval GROUP="Group" <BR /> | eval SHORTDESCRIPTION="Short Description"<BR /> | table host _raw SourcePath Config.Item PAGER TEAM GROUP SHORTDESCRIPTION<BR /> | rex mode=sed "s/\,//g"<BR /> | rex mode=sed "s/[^a-zA-Z0-9</EM>-.]+/ /g"<BR /> | outputcsv file.csv</P> <P>Everything is working as required, I am just not too sure what should I match <STRONG><EM>eval SourcePath=</EM></STRONG> with in order to obtain the string of the source log file's path?<BR /> Anyone able to assist?</P> <P>Thanks a bunch!<BR /> Tom</P> Thu, 16 Apr 2020 15:18:23 GMT https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473490#M133216 tom1981 2020-04-16T15:18:23Z https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473491#M133217 <P>It's difficult to answer without knowing your data. Please share some sample (sanitized) events.</P> Thu, 16 Apr 2020 16:49:34 GMT https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473491#M133217 richgalloway 2020-04-16T16:49:34Z https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473492#M133218 <P>Hello,</P> <P>Sorry for the delay.<BR /> Please see in the answer section for the event examples (cannot add pictures here)</P> <P>Thanks a lot!</P> Sat, 18 Apr 2020 16:49:22 GMT https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473492#M133218 tom1981 2020-04-18T16:49:22Z https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473493#M133219 <P>Events:</P> <P>Before formatting;<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8677iAFC48A030B43F150/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>After formating:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8678i288A7BD8B93704F7/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sat, 18 Apr 2020 16:49:41 GMT https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473493#M133219 tom1981 2020-04-18T16:49:41Z https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473494#M133220 <P>Bump to top.</P> Mon, 27 Apr 2020 17:40:05 GMT https://community.splunk.com/t5/Splunk-Search/Adding-source-path-to-table-output/m-p/473494#M133220 tom1981 2020-04-27T17:40:05Z