topic Re: Extraction of extension from filename and flagging them in Splunk Search

Extraction of extension from filename and flagging them

Jananee_iNautix — Mon, 13 Jan 2014 12:30:56 GMT

I have to do something like according to the extension of the filename that i extract from logs i want to flag them.
For example if filename is of.txt extension I should flag them as T.How can i do that in splunk?can anyone help me on this.

I should get the following result
filename flag
abc.txt T

Re: Extraction of extension from filename and flagging them

linu1988 — Mon, 13 Jan 2014 12:44:46 GMT

Hello,
If you mean to say the first letter after the extension starts then below will do it,

source=..| rex field=filename "\\.(?<Flag>\S+)"|eval Flag=upper(Flag)|eval Flag=case(Flag="ZIP", "C", Flag="TAR", "T", Flag="CSV" OR Flag="TXT" OR Flag="PDF" , "U")|table filename,Flag

Thanks

Re: Extraction of extension from filename and flagging them

somesoni2 — Mon, 13 Jan 2014 13:55:21 GMT

And if not just always the first letter of the file extension, then you should create a lookup table file with file extension to flag mapping and then do a lookup.

source=..| rex field=filename "\\.(?.*)" | lookup File_Extension OUTPUT Flag

Re: Extraction of extension from filename and flagging them

Jananee_iNautix — Wed, 15 Jan 2014 05:14:43 GMT

i want to get the result like if the file is with.ZIP extension display as "c",with .tar extension display "t",else for all other things display as "u".Can you give search query for this.
filename flag
asd.ZIP c
fefew.tar t
werw.csv u
ew.txt u
fgwe.pdf u

Re: Extraction of extension from filename and flagging them

linu1988 — Wed, 15 Jan 2014 17:45:17 GMT

As Somesh suggested you need to get a lookup which will get you the FLAG details. Alternative is to use a case/if statement. Have updated the query