topic Re: regex to find source path that contains spaces in Splunk Search

How to create regex to find source path that contains spaces?

sarit_s — Thu, 03 Aug 2023 21:03:55 GMT

Hello

I have sources that contain white spaces and I wand to count them

What is the regex to find all the sources with spaces ?

Thanks

gcusello — Thu, 03 Aug 2023 09:34:20 GMT

to help you, it's manadatory a sample of your logs, anyway, you can use the other chars to extract a regex.

So, if you want to extract the folder from this log:

2023-08-02 host1 11.11.11 10.2.34.12 path="C:\Program Files\folder 1\my_file.docx",

you could try something like this:

| rex "path\=\".*\\(?<folder>[^\\]+)\\\w+\.\w+\""

Ciao.

Giuseppe

sarit_s — Thu, 03 Aug 2023 09:36:45 GMT

Hello

Thanks for your reply

this is an example of my path:

C:\Projects\API Managment Logging\Logs\*.txt

Also, the regex you attached is invalid 😞

sarit_s — Thu, 03 Aug 2023 10:02:32 GMT

also , maybe I wasn't clear enough

I want to count all the hosts that have sources with spaces

I don't want to extract the folder, I just need to know how many sources with white space I have

ITWhisperer — Thu, 03 Aug 2023 10:21:16 GMT

| regex source="\s"

gcusello — Thu, 03 Aug 2023 11:06:41 GMT

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉