Getting Data In

How to change the name of the source path that is being shown in the results?

Explorer

I have a search that gives me two groups separated by two different sources but I do not want to have the source path showing, I want to rename it, how can I do that?

For example, to show sourcegroup1 and sourcegroup2?

alt text

Thanks

0 Karma

Esteemed Legend

Like this:

... | rex field=source mode=sed "s/\/.*$//"
0 Karma

Motivator

Multiple ways to approach this

If your list is small, you can use a simple case statement

| eval source=case(match(source, "source1"), "sourcegroup1", match(source, "source2"), "sourcegroup2")

If your list is larger, use a lookup file with the mappings

| lookup <lookupfile> <source-old> as source OUTPUT <source-new >as source

Need to extract part of your source as the new source? refer to the rex examples provided by @starcher and @mayurr98

Case - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions
Lookup - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Lookup

Explorer

@arjunpkishore5 it almost did the trick, the first approach. But now it does show anything. I get the column "source" but nothing on each line (no sourcegroup1 or sourcegroup2).

Thanks

0 Karma

Motivator

Is the value of source in mixed case? As in , has both upper and lower case characters?

0 Karma

Explorer

Yes they do, in both sources.

0 Karma

Motivator

in that case, please change the case statement to the following.

| eval source=case(match(lower(source), "source1"), "sourcegroup1", match(lower(source), "source2"), "sourcegroup2")

match is case sensitive. so I'm force converting the value to lower case so that they match to the lowercase pattern

0 Karma

Explorer

Didnt work, keep getting them in blank.

0 Karma

Motivator

Hi, I was away for a few days. Is your issue resolved now ?

0 Karma

SplunkTrust
SplunkTrust

Try this:

| makeresults 
| eval source="source1/log.log" 
| rex field=source mode=sed "s/^[a-zA-Z]+(\d+)\/.*/sourcegroup\1/g"
0 Karma

SplunkTrust
SplunkTrust

example

| makeresults 
| eval source="source1/log.log" 
| rex field=source "^(?P<source_group>[^\/]+)" 
| fields - source
0 Karma