rex regex to extract first folder name from the path

sim_tcr — Tue, 29 Sep 2020 09:53:51 GMT

Hello,

My source filed has value such as,

*/icsws/log/INSTANCE1/was/base/icsws_ca_server/SystemOut.log*
/icsws*/log/INSTANCE1/ihs/access_log
/wcics/log/INSTANCE1/ihs/access_log
...
...*

I would like to extract the first folder names (icsws*, wcics) from above to field named VAH.
can someone help me complete *| rex field=source ".."**

Thanks,
Simon Mandy

Re: rex regex to extract first folder name from the path

javiergn — Tue, 07 Jun 2016 09:09:13 GMT

Try this:

| rex field=source "^/(?<first_folder>[^/]+)"

topic rex regex to extract first folder name from the path in Splunk Search

rex regex to extract first folder name from the path

Re: rex regex to extract first folder name from the path