Filter according folders of the source filed

[avitallange]

Hi,

I would like to have the option to filter according the sub folders of the source.
For example:
If my source is: E:\Logs\ComponentNameX\InstanceY\logZ.txt

I would like extract the folder of ComponentName and the folder of InstanceName.

Could you please help to do this?

Thanks!

[mloven_splunk]

avitallange,

I haven't done this before, but I'd guess that this would work.

In transforms.conf

[myextraction]
SOURCE_KEY = MetaData:Source 
REGEX = E:\\Logs\\([^\\]+)\\([^\\]+)\\.*\.txt
FORMAT = component::$1 instance::$2

And in props.conf

[your_sourcetype_name]
REPORT-myextraction = myextraction