topic Re: Drop everything after last occurrence of Symbol in Splunk Search

What regex to use to drop everything after the last occurrence of a symbol?

jpfrancetic — Wed, 09 Nov 2022 15:13:31 GMT

Hi Splunk Community,

I am working on a regex to filter the sources I am getting from logs. I am trying to drop everything after the last "/" in the field but I am having problems filtering.

My current sources look something like: /db2audit/fs01/db2inst1/extract/abc123/file.del

I am trying to filter it to look like: /db2audit/fs01/db2inst1/extract/abc123

Thanks in advance!

Re: Drop everything after last occurrence of Symbol

richgalloway — Wed, 09 Nov 2022 14:36:30 GMT

Try this command.

| rex mode=sed field=foo "s/(.*)\/.*?$/\1/"

Re: Drop everything after last occurrence of Symbol

gcusello — Wed, 09 Nov 2022 14:39:04 GMT

Hi @jpfrancetic,

if the first part is fixed in the first four folders, you could extract something like this:

| rex field=source "^(?<path>(\/\w+){4}).*(?<filename>\/\w+\.\w+$)"

that you can test at https://regex101.com/r/j7XgJ5/1

Ciao.

Giuseppe

Re: Drop everything after last occurrence of Symbol

gcusello — Thu, 10 Nov 2022 07:23:11 GMT

Hi @jpfrancetic,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉