Dashboards & Visualizations

Get the length of a file name before the extension

landen99
Motivator

I searched this one quite a bit because the solution seemed like it would be really easy.

Given the filename field has only a name.extension, I want to count the length of the name, which is 4 in this case.

In Excel, I would just do =len(left(A2,Find(“.“,A2))), I believe. Seems really easy.

Examples:
a.txt 1
bee.bat 3
ce.command 2

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Take a look at this:

| stats count | eval file="a.txt bee.bat ce.command" | makemv file | mvexpand file | eval count = length(replace(file, "\.[^.]+$", ""))

That creates a field file with your examples, and computes a field count that matches your results - that's the eval at the end, same strategy as your Excel computation.

View solution in original post

landen99
Motivator

The actual excel code would really be: =LEN(LEFT(A1,FIND(".",A1,1)-1))

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Take a look at this:

| stats count | eval file="a.txt bee.bat ce.command" | makemv file | mvexpand file | eval count = length(replace(file, "\.[^.]+$", ""))

That creates a field file with your examples, and computes a field count that matches your results - that's the eval at the end, same strategy as your Excel computation.

landen99
Motivator

Perfect. Thank you very much for your insight and guidance here.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

As for your question "-What is the difference between your regex and ^(.*)\..*$? They seem to do the same thing as well.", yours looks for the first literal dot while mine looks for the last literal dot. An example:

some.other.file(.name) --> my regex will match only the .name, length is 14
some(.other.file.name) --> your regex will match the entire string, and when replaced with $1 the remaining length will be 4
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I have edited the comment, the four-spaces-block needs an empty line before it to work properly. Now asterisks and all that are rendered correctly. For posting code blocks inline surround it by backticks (`).

0 Karma

landen99
Motivator

I added 4 spaces before each regex expression. Is that what you were after?

I wish this site was easier to post to. I have a lot of difficulty with the captcha working and there are no tools for inserting html codes like spoiler, code, image, etc to the post.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

My regex works like this, from right to left:

  • Anchor to the end of the field
  • Match one or more characters that are not a literal dot
  • Match one literal dot

Then that match is removed from the string by the replace, so the length only counts the filename without the extension. Some examples, with parentheses denoting the matched and removed part:

file(.name) --> length is 4
some.other.file(.name) --> length is 14
(.hidden) --> length is 0
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I start the search with | stats count to get an empty event to work with, no need for data from any index. The first eval | makemv | mvexpand builds simulation data, the eval at the end is the part you need for your search... it might look something like this:

index=foo sourcetype=bar filename=* | eval filename_length = length(replace(filename, "\.[^.]+$", ""))

Your regexes are hard to read, Splunk Answers treats backslashes, asterisks, and underscores within regular text as special characters. Prepend four spaces to your regexes to avoid that.

0 Karma

landen99
Motivator

Your answer helped me to build the search below for good results:

| eval file_length=length(replace(filename, "\.[^.]+$", ""))
  • Does your search produce the same results or something different than the search above?
  • Also, why do you invoke stats count and count in eval?

Here are a few of the regex suggestions I have read:

([^\.]*)
/^(.+)(\.[^ .]+)?$/
\.[^.]*$
(.+?)(\.[^.]*$|$)
(.+?)\.[^\.]+$
(.+?)(\.[^\.]+$|$)
^(.*)\..*$

Learning regex atm.
-What is the difference between your regex and ^(.*)\..*$? They seem to do the same thing as well.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...