Getting Data In

How do i extract data from my event source filename

pradiptam
Explorer

I have multiple logfiles like TEST_SRC_FR.txt, TEST_SRC_IN.txt, TEST_SRC_AU.txt which are my source files. Now i want to extract the last two letters like "FR" from TEST_SRC_FR.txt.

Any idea how to get them during search time.

Regards,

Pradipta

0 Karma

Richfez
SplunkTrust
SplunkTrust

Sure!

... | rex field=source "(?<LastTwoLetters>..)\.txt$"

That assume they're the literal field source and that they ALWAYS end with "txt".

Modifications can be made for other similar scenarios, but you'll have to be very specific in describing them. 🙂

Happy Splunking,
Rich

pradiptam
Explorer

Thanks its also working, checking which one to use in my program

Regards,
Pradipta

0 Karma

493669
Super Champion

try this run anywhere search:

| makeresults |eval _raw="TEST_SRC_FR.txt"|rex ".*_(?<name>\w{2})"

in your case you can use as

index=<indexname>| rex field=source ".*_(?<name>\w{2})"

also you can make this regex in props.conf

pradiptam
Explorer

Great its working fine for me.

regards,
Pradipta

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...