Alerting

Covert Object name into column name using back slash

shishirkumar
Engager

Hello Team,

Could anyone can help me in spiting Object name into column name

Like In Query we are getting Object name as in One Column :

R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt

I wanted to spit into 6 column as A ,B,C,D,E,F

Output will be like this

Header table : A |B|C|D|E|F
Row Data : R: |ClientReports|OpenCaseReport|DataFiles|AmeriHealthOpen|CaseReportt_20101210.txt

Tags (1)
0 Karma

whrg
Motivator

Hello @shishirkumar,

Check out the rex command. You can use it to extract new fields from existing fields at search time:

| makeresults count=1 | eval Object_name="R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt"
| rex field=Object_name "^(?<A>[^\\\\]+)\\\\(?<B>[^\\\\]+)\\\\(?<C>[^\\\\]+)\\\\(?<D>[^\\\\]+)\\\\(?<E>[^\\\\]+)\\\\(?<F>[^\\\\]+)"
| table A,B,C,D,E,F

This will give you:

A    B               C                D           E                  F
R:   ClientReports   OpenCaseReport   DataFiles   AmeriHealth_Open   CaseReport_20101210.txt

You could also save this regular expression as a field extraction so that it extracts the fields automatically.

shishirkumar
Engager

it not working if i am remove hardcoded value that is "R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt" with my column name ?

Could You please help to resolve that.

0 Karma

whrg
Motivator

What is the name of the column?
Did you set "| rex field=YOUR_COLUMN_NAME ..." accordingly?

0 Karma

shishirkumar
Engager
 | makeresults count=1 | eval Object_name=Object_name
 | rex field=Object_name "^(?<A>[^\\\\]+)\\\\(?<B>[^\\\\]+)\\\\(?<C>[^\\\\]+)\\\\(?<D>[^\\\\]+)\\\\(?<E>[^\\\\]+)\\\\(?<F>[^\\\\]+)"
 | table A,B,C,D,E,F

Object Name is column name

This is Original Query where I wanted to add this.

index=wineventlog host=ATLINFS3 sourcetype="WinEventLog:Security" ClientReports NOT "Symantec Endpoint Protection" Object_Name = ".PDF" OR Object_Name = ".XLSX" OR Object_Name = ".TXT" | where Account_Name!="svisadmin" and Object_Name != "~$$*" | stats count(Object_Name) as TotalCount by Object_Name | sort -TotalCount

0 Karma

whrg
Motivator

Try the following:

index=... | where ... | stats ... | sort ...
| rex field=Object_Name "^(?<A>[^\\\\]+)\\\\(?<B>[^\\\\]+)\\\\(?<C>[^\\\\]+)\\\\(?<D>[^\\\\]+)\\\\(?<E>[^\\\\]+)\\\\(?<F>[^\\\\]+)"

(The makeresults and eval line were just for testing purposes.)

I changed "rex field=Object_name" to "rex field=Object_Name". Field names are case sensitive.

If this does not work, could you post a screenshot of the results from this query? (Specifically of the Object_Name column.)

You can use regex101.com for testing regular expressions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...