- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![landen99 landen99](https://community.splunk.com/legacyfs/online/avatars/212991.jpg)
I searched this one quite a bit because the solution seemed like it would be really easy.
Given the filename field has only a name.extension, I want to count the length of the name, which is 4 in this case.
In Excel, I would just do =len(left(A2,Find(“.“,A2))), I believe. Seems really easy.
Examples:
a.txt 1
bee.bat 3
ce.command 2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Take a look at this:
| stats count | eval file="a.txt bee.bat ce.command" | makemv file | mvexpand file | eval count = length(replace(file, "\.[^.]+$", ""))
That creates a field file
with your examples, and computes a field count
that matches your results - that's the eval at the end, same strategy as your Excel computation.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![landen99 landen99](https://community.splunk.com/legacyfs/online/avatars/212991.jpg)
The actual excel code would really be: =LEN(LEFT(A1,FIND(".",A1,1)-1))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Take a look at this:
| stats count | eval file="a.txt bee.bat ce.command" | makemv file | mvexpand file | eval count = length(replace(file, "\.[^.]+$", ""))
That creates a field file
with your examples, and computes a field count
that matches your results - that's the eval at the end, same strategy as your Excel computation.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![landen99 landen99](https://community.splunk.com/legacyfs/online/avatars/212991.jpg)
Perfect. Thank you very much for your insight and guidance here.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
As for your question "-What is the difference between your regex and ^(.*)\..*$
? They seem to do the same thing as well.", yours looks for the first literal dot while mine looks for the last literal dot. An example:
some.other.file(.name) --> my regex will match only the .name, length is 14
some(.other.file.name) --> your regex will match the entire string, and when replaced with $1 the remaining length will be 4
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
I have edited the comment, the four-spaces-block needs an empty line before it to work properly. Now asterisks and all that are rendered correctly. For posting code blocks inline surround it by backticks (`).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![landen99 landen99](https://community.splunk.com/legacyfs/online/avatars/212991.jpg)
I added 4 spaces before each regex expression. Is that what you were after?
I wish this site was easier to post to. I have a lot of difficulty with the captcha working and there are no tools for inserting html codes like spoiler, code, image, etc to the post.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
My regex works like this, from right to left:
- Anchor to the end of the field
- Match one or more characters that are not a literal dot
- Match one literal dot
Then that match is removed from the string by the replace, so the length only counts the filename without the extension. Some examples, with parentheses denoting the matched and removed part:
file(.name) --> length is 4
some.other.file(.name) --> length is 14
(.hidden) --> length is 0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
I start the search with | stats count
to get an empty event to work with, no need for data from any index. The first eval | makemv | mvexpand
builds simulation data, the eval
at the end is the part you need for your search... it might look something like this:
index=foo sourcetype=bar filename=* | eval filename_length = length(replace(filename, "\.[^.]+$", ""))
Your regexes are hard to read, Splunk Answers treats backslashes, asterisks, and underscores within regular text as special characters. Prepend four spaces to your regexes to avoid that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![landen99 landen99](https://community.splunk.com/legacyfs/online/avatars/212991.jpg)
Your answer helped me to build the search below for good results:
| eval file_length=length(replace(filename, "\.[^.]+$", ""))
- Does your search produce the same results or something different than the search above?
- Also, why do you invoke stats count and count in eval?
Here are a few of the regex suggestions I have read:
([^\.]*)
/^(.+)(\.[^ .]+)?$/
\.[^.]*$
(.+?)(\.[^.]*$|$)
(.+?)\.[^\.]+$
(.+?)(\.[^\.]+$|$)
^(.*)\..*$
Learning regex atm.
-What is the difference between your regex and ^(.*)\..*$
? They seem to do the same thing as well.
![](/skins/images/396DDBEEAC295EB5FEC41FF128E8AC0A/responsive_peak/images/icon_anonymous_message.png)