topic Re: Extracting File Type in Splunk Search

Extracting File Type

behymejt2012 — Mon, 06 May 2013 13:56:02 GMT

Hi Everyone,

Trying to extract the File Type from Files (ex: pst, xml, etc). I have tried to split it:

eval split =Split(File,".") | eval type=mvindex(split,1)

But a problem occurs when files like: "2012-12-08 15.36.01.jpg" show up due to the extra "." in the file name.

Is there any recommended rex, or method that can be used to pull the file type from the end of the File name instead of trying to split everything up.

Thanks

Re: Extracting File Type

Ayn — Mon, 06 May 2013 14:09:42 GMT

If you read the docs, they have the following to say about the mvindex command:

For mvindex(mvfield, startindex, [endindex]), endindex is inclusive and optional; both startindex and endindex can be negative, where -1 is the last element.

So, eval type=mvindex(split,-1) should do the trick.

Otherwise, if you want a rex solution, you could do

... | rex field=File "(?<type>[^.]+)$"

Re: Extracting File Type

behymejt2012 — Mon, 06 May 2013 15:22:30 GMT

Thanks,

When I try and use the rex I get the following error (havent really used rex): "Error in 'rex' command: The regex '([^.]+)$' does not extract anything. It should specify at least one named group. Format: (?...)."

Re: Extracting File Type

Ayn — Mon, 06 May 2013 20:53:08 GMT

Sorry, like it says - you need to include a group name at the beginning. I updated my answer with correct syntax.