topic Re: How to extract the file extensions from Filename field values into a new field and filter against a static list? in Splunk Search

How to extract the file extensions from Filename field values into a new field and filter against a static list?

jclemons7 — Thu, 27 Aug 2015 21:03:53 GMT

Hello

I have a field called "Filename" and I'd like to attain the equivalent of SQL's Where FieldName IN (). The field has values as follows of course:

Test.txt
MyFiles.html
My Compiled Code.exe

I want to basically say "give me every FileName where extension in (txt,exe)". I'd also like to end up with a field called "extension" that does not include the preceding .

How I would do that in SQL is to parse the string after the first dot, then compare it to a list using the IN keyword..

Any help is greatly appreciated..

Re: How to extract the file extensions from Filename field values into a new field and filter against a static list?

MuS — Thu, 27 Aug 2015 21:58:02 GMT

Hi jclemons7,

based on your provided example you can try something like this:

your base search here to get the list 
| rex field="Filename" "\.(?<extension>[^\.]*$)" 
| search extension="txt" OR extension="exe" | ...

This will create the extension field using the regex to match everything after the last . which is not a ., search for extension txt or exe and you can use it to process further down the Splunk search.

Hope this helps to get you started ...

cheers, MuS

Re: How to extract the file extensions from Filename field values into a new field and filter against a static list?

mrgibbon — Thu, 14 Jul 2016 23:35:39 GMT

Thanks MuS!