topic Timechart by source with only basename of source in Splunk Search

Timechart by source with only basename of source

wang — Thu, 26 Jul 2012 05:02:23 GMT

I have a timechart that plots response time by source:
index=myidx duration | timechart avg(duration) by source

Because the name of the source are long, the legend on the right hand side of the plot takes over half the panel, squishing the chart to the left. Is there anyway I can do a "basename" of the source path, using just the file name, omitting the directory path?

I suppose I could assign a specific sourcetype for each file but I'm hoping I can just somehow regex basename of source.

Re: Timechart by source with only basename of source

Ayn — Thu, 26 Jul 2012 07:06:01 GMT

Sure, just grab the last portion of the path, write it to another field and then timechart by that instead:

index=myidx duration | rex field=source "/(?<source_file>[^/]+)$" | timechart avg(duration) by source_file

Re: Timechart by source with only basename of source

lguinn2 — Thu, 26 Jul 2012 07:06:46 GMT

Try this:

index=myidx duration
| eval source = replace(source,"\\","/")
| eval fileNameParts=split(source, "/")
| eval source = mvindex(fileNameParts,mvcount(fileNameParts)-1)
| timechart avg(duration) by source

This splits the source name into parts, and then assigns the last part to source. I also included the replace statement to flip any Windows-style path separators, so this should work even in a mixed environment.

Re: Timechart by source with only basename of source

wang — Thu, 26 Jul 2012 21:10:23 GMT

Thanks. The regex works great!