How to create 2 regex to extract the "intranet" and the "output"?

[Bradd23]

Hi,  we have some data that contains a hierarchy of folders that we want to extract from the source path, the raw data looks like this : 

source= /usr/local/intranet/areas/ua1/output/MUN

we would like to create 2 regex to extract the "intranet" and the "output"

Can someone please help

Thanks

[somesoni2]

A similar problem (extracting fields from source) is solved here:

https://community.splunk.com/t5/Splunk-Search/extract-a-field-from-event-source-filename/m-p/36029

Depending upon the order of the words and what part is static, the regex will change accordingly.

e.g. if "intranet" is always the 3rd segment and "output" is 6th, following regex could work:

^\/usr\/local\/(?<fieldName1>[^\/]+)\/([^\/]+\/){2}(?<fieldName2>[^\/]+) in source

[gcusello]

Hi @Bradd23,

you could use a regex like the following

| rex field=source "^(\/\w+){2}\/(?<field1>\w+)\/(?<field2>\w+)"

that you can test at https://regex101.com/r/zXtNKV/1

Ciao.

Giuseppe