Dashboards & Visualizations

How to extract field from source path?

Mrig342
Contributor

Hi All,

I want to extract few fields available in the source path. For e.g. the source path is:

/apps/stats/domain/miccep3_mic_ce_sit/4.1/tra/domain/miccep3_mic_ce_sit/application/logs/Host_MediationServices_STE4_0-1-HOST_MediationServices_4_Host_MediationServices_CSAWC.log

 

Here I want to capture below 3 details:

1. From "/apps/stats/domain/miccep3_mic_ce_sit" part --- Need to capture "miccep3_mic_ce_sit" as "Domain_Name"

2. Need to capture "/apps/stats/domain/miccep3_mic_ce_sit/4.1/tra/domain/miccep3_mic_ce_sit/application/" part of the source path as "Application_Path"

3. After /logs directory in the path I want to capture the part "Host_MediationServices_STE4_0-1" as "Application_Name"

Please help create a query to capture the above fields from the source path.

 

Your kind help is highly appreciated.

Thank You..!!

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Mrig342,

answering to your questions:

1)

| rex field=source "^\/\w+\/\w+\/\w+\/(?<Domain_Name>\w+)

that you can test at https://regex101.com/r/l7KjrG/1 

2)

| rex field=source "^(?<Application>.+application)\/"

that you can test at https://regex101.com/r/l7KjrG/2

3)

| rex field=source "^.*logs\/(?<Application_Name>.*)-HOST"

that you can test at https://regex101.com/r/l7KjrG/3

this is the hardest because there are chars (like - that are special chars so I cannot take using \w, this regex runs if there's always the word "HOST" in your path.

Ciao.

Giuseppe

View solution in original post

Mrig342
Contributor

Hi @gcusello ,

Thank you for your inputs.. The above queries helped me getting my expected field values.

Your kind help is highly appreciated.

Thank you very much..!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mrig342,

answering to your questions:

1)

| rex field=source "^\/\w+\/\w+\/\w+\/(?<Domain_Name>\w+)

that you can test at https://regex101.com/r/l7KjrG/1 

2)

| rex field=source "^(?<Application>.+application)\/"

that you can test at https://regex101.com/r/l7KjrG/2

3)

| rex field=source "^.*logs\/(?<Application_Name>.*)-HOST"

that you can test at https://regex101.com/r/l7KjrG/3

this is the hardest because there are chars (like - that are special chars so I cannot take using \w, this regex runs if there's always the word "HOST" in your path.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...