Get the length of a file name before the extension

[landen99]

I searched this one quite a bit because the solution seemed like it would be really easy.

Given the filename field has only a name.extension, I want to count the length of the name, which is 4 in this case.

In Excel, I would just do =len(left(A2,Find(“.“,A2))), I believe. Seems really easy.

Examples:
a.txt 1
bee.bat 3
ce.command 2

[landen99]

The actual excel code would really be: =LEN(LEFT(A1,FIND(".",A1,1)-1))

[martin_mueller · Accepted solution]

Take a look at this:

| stats count | eval file="a.txt bee.bat ce.command" | makemv file | mvexpand file | eval count = length(replace(file, "\.[^.]+$", ""))

That creates a field file with your examples, and computes a field count that matches your results - that's the eval at the end, same strategy as your Excel computation.

[landen99]

Perfect. Thank you very much for your insight and guidance here.

[martin_mueller]

As for your question "-What is the difference between your regex and ^(.*)\..*$? They seem to do the same thing as well.", yours looks for the first literal dot while mine looks for the last literal dot. An example:

some.other.file(.name) --> my regex will match only the .name, length is 14
some(.other.file.name) --> your regex will match the entire string, and when replaced with $1 the remaining length will be 4

[martin_mueller]

I have edited the comment, the four-spaces-block needs an empty line before it to work properly. Now asterisks and all that are rendered correctly. For posting code blocks inline surround it by backticks (`).

[landen99]

I added 4 spaces before each regex expression. Is that what you were after?

I wish this site was easier to post to. I have a lot of difficulty with the captcha working and there are no tools for inserting html codes like spoiler, code, image, etc to the post.

[martin_mueller]

My regex works like this, from right to left:

• Anchor to the end of the field
• Match one or more characters that are not a literal dot
• Match one literal dot

Then that match is removed from the string by the replace, so the length only counts the filename without the extension. Some examples, with parentheses denoting the matched and removed part:

file(.name) --> length is 4
some.other.file(.name) --> length is 14
(.hidden) --> length is 0

[martin_mueller]

I start the search with | stats count to get an empty event to work with, no need for data from any index. The first eval | makemv | mvexpand builds simulation data, the eval at the end is the part you need for your search... it might look something like this:

index=foo sourcetype=bar filename=* | eval filename_length = length(replace(filename, "\.[^.]+$", ""))

Your regexes are hard to read, Splunk Answers treats backslashes, asterisks, and underscores within regular text as special characters. Prepend four spaces to your regexes to avoid that.

[landen99]

Your answer helped me to build the search below for good results:

| eval file_length=length(replace(filename, "\.[^.]+$", ""))

• Does your search produce the same results or something different than the search above?
• Also, why do you invoke stats count and count in eval?

Here are a few of the regex suggestions I have read:

([^\.]*)
/^(.+)(\.[^ .]+)?$/
\.[^.]*$
(.+?)(\.[^.]*$|$)
(.+?)\.[^\.]+$
(.+?)(\.[^\.]+$|$)
^(.*)\..*$

Learning regex atm.
-What is the difference between your regex and ^(.*)\..*$? They seem to do the same thing as well.