topic Re: Regex help in Splunk Search

Regex help

SS1 — Thu, 22 Jul 2021 03:49:22 GMT

Hi,

I have below sources,

source = C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log

Instead of displaying full paths i want the source to display just, can we have a rex for this one

source = user1

source = user2

source = user3

source = user4

Re: Regex help

kamlesh_vaghela — Thu, 22 Jul 2021 05:09:03 GMT

@SS1

Can you please try this?

YOUR_SEARCH | rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\" | table source user

My Sample Search :

| makeresults | eval _raw="_raw source = C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log source = C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract | rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\" | table source user

Thanks
KV
▄︻̷̿┻̿═━一 ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Regex help

SS1 — Thu, 22 Jul 2021 18:12:10 GMT

No, this was regex was unable to extract the user field

Re: Regex help

gcusello — Fri, 23 Jul 2021 06:20:07 GMT

Hi @SS1,

the solution of @kamlesh_vaghela is running on my Splunk.

Eventually, you could try something near:

| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"

to test in this way:

Ciao.

Giuseppe

Re: Regex help

SS1 — Sun, 25 Jul 2021 21:57:03 GMT

Yes, this working now. Thanks @kamlesh_vaghela @gcusello