topic How to extract filename form Source field in Splunk Search

How to extract filename form Source field

deepthi5 — Fri, 10 Jul 2015 08:01:16 GMT

Hi team,

I have got a csv files indexed into splunk with names SOURCE= C:\Netwrokanalysis\germany.csv ,c:\networkanalysis\singapore.csv i want to extract country name form this SOURCE field that is germany,singapore

Thanks ,
Deepthi

Re: How to extract filename form Source field

sc0tt — Fri, 10 Jul 2015 09:35:50 GMT

I'm sure there is a more elegant solution, but would something like | eval country = mvindex(split(substr(source,18),"."),0) work?

Edit: This should work as well

rex field=source "c:networkanalysis(?<country>\S+).csv"

Re: How to extract filename form Source field

joao_amorim — Fri, 10 Jul 2015 09:46:32 GMT

I didn't test it but it should work if the length of the first part of the SOURCE string is always the same.
You can also apply a rex command after applying the split command, but it will do the same than the command proposed by sc0tt

Re: How to extract filename form Source field

gyarici — Fri, 10 Jul 2015 09:48:18 GMT

Also assigning different sourcetype per county csv file is other option and you can handle it better for your future search queries.

In your input.conf file;

[monitor://C:\networkanalysisgermany.csv]
disabled = false
sourcetype = Germany

[monitor://C:\networkanalysissingapore.csv]
disabled = false
sourcetype = Singapore

Create Sourcetypes

Hope it helps

Gokhan

Re: How to extract filename form Source field

sc0tt — Fri, 10 Jul 2015 09:53:46 GMT

This is probably the best solution.