I have several log files as source of Splunk events.
C:\logs\Srv1\file1_2019-05-06.log
C:\logs\Srv84\file3_2019-05-06.log
C:\logs\Glob9\file18_2019-05-06.log
I am trying to extract the immediate parent directory name from the source
field of events. So in a custom extracted field "appname", I am hoping to get values Srv1, Srv84 and Glob9 from examples above.
Here's what I am doing.
Splunk Web > Settings > Fields > Fields Extractions > Add new
Destination app: search
Name: source_app_name
Apply to: source
named: app_name
Type: Inline
Extraction/Transform: ^.+\x5C(?<appname>(.+))\x5C[^\x5C]*$
Sharing: Global, All apps, Read permission to everyone.
When I run my search ...| extract reload=t
I can't find appname
field in All fields. All fields is selected in the Select field list.
Am I doing anything wrong with my field extraction, or with my search?
Hello @arpitporpay
The best way to do this is:
Go to Splunk Web > Settings > Fields > Fields Extractions > Add new
then add the below attributes:
app_name: <your app name>
name: source_app_name
sourcetype : < as per your requirement> --- the above mentioned source is incorrect as it is asking for which source it need to apply so it is better to use sourcetype.
Type: uses trasform
extraction: appname
Go to Splunk Web > Settings > Fields > Field transformations > Add new
destination_app: <your app name>
name : appname
type: regex-based
regular expression: ^.+\x5C(?<appname>(.+))\x5C[^\x5C]*$
source_key : source
Thanks!
Hello @arpitporpay
The best way to do this is:
Go to Splunk Web > Settings > Fields > Fields Extractions > Add new
then add the below attributes:
app_name: <your app name>
name: source_app_name
sourcetype : < as per your requirement> --- the above mentioned source is incorrect as it is asking for which source it need to apply so it is better to use sourcetype.
Type: uses trasform
extraction: appname
Go to Splunk Web > Settings > Fields > Field transformations > Add new
destination_app: <your app name>
name : appname
type: regex-based
regular expression: ^.+\x5C(?<appname>(.+))\x5C[^\x5C]*$
source_key : source
Thanks!
Otherwise:
props.conf
[your_sourcetype]
REPORT-appname1= appname
transforms.conf
[appname]
REGEX= ^.+\x5C(?(.+))\x5C[^\x5C]*$
SOURCE_KEY = source
@arpitpropay : Could you please accept the answer to close the conversation.
Thanks @vishaltaneja07011993 your solution (using field transformation in field extraction) worked for me.