topic Re: How to extract the application name from the log file path or process in a search? in Splunk Search

How to extract the application name from the log file path or process in a search?

vikasshinde — Tue, 07 Apr 2015 00:59:20 GMT

My goal is to create an application list running from all servers in the form of table.

index=unix* host=* sourcetype=ps  user="*" user=* NOT user=root

This way I am getting all the processes owned by nonroot users. I am trying to identify application name (web,app and db) apache(with /app/apache/"application name", jboss application name (/app/jboss/servers/"app name" and db name (pmon).

To all experts, is there any way to extract application/db name (web/app/db) using single search so that it can be presented as a table?

Table format:

Hostname Webname Applicationname DBname

Re: How to extract the application name from the log file path or process in a search?

woodcock — Wed, 13 May 2015 15:28:07 GMT

Try this:

... | rex field=_source "/(?:(?:app/apache)|(?:app/jboss/servers)/(?&lt;app&gt;[^\]*)

Re: How to extract the application name from the log file path or process in a search?

stephane_cyrill — Wed, 13 May 2015 16:17:42 GMT

try this:

   index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]

Re: How to extract the application name from the log file path or process in a search?

regexcracker — Wed, 13 May 2015 18:23:28 GMT

Please provide some small piece of logger to create exact regex