Getting Data In

How to change the name of the source path that is being shown in the results?

diabinho
Explorer

I have a search that gives me two groups separated by two different sources but I do not want to have the source path showing, I want to rename it, how can I do that?

For example, to show sourcegroup1 and sourcegroup2?

alt text

Thanks

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=source mode=sed "s/\/.*$//"
0 Karma

arjunpkishore5
Motivator

Multiple ways to approach this

If your list is small, you can use a simple case statement

| eval source=case(match(source, "source1"), "sourcegroup1", match(source, "source2"), "sourcegroup2")

If your list is larger, use a lookup file with the mappings

| lookup <lookupfile> <source-old> as source OUTPUT <source-new >as source

Need to extract part of your source as the new source? refer to the rex examples provided by @starcher and @mayurr98

Case - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions
Lookup - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Lookup

diabinho
Explorer

@arjunpkishore5 it almost did the trick, the first approach. But now it does show anything. I get the column "source" but nothing on each line (no sourcegroup1 or sourcegroup2).

Thanks

0 Karma

arjunpkishore5
Motivator

Is the value of source in mixed case? As in , has both upper and lower case characters?

0 Karma

diabinho
Explorer

Yes they do, in both sources.

0 Karma

arjunpkishore5
Motivator

in that case, please change the case statement to the following.

| eval source=case(match(lower(source), "source1"), "sourcegroup1", match(lower(source), "source2"), "sourcegroup2")

match is case sensitive. so I'm force converting the value to lower case so that they match to the lowercase pattern

0 Karma

diabinho
Explorer

Didnt work, keep getting them in blank.

0 Karma

arjunpkishore5
Motivator

Hi, I was away for a few days. Is your issue resolved now ?

0 Karma

mayurr98
Super Champion

Try this:

| makeresults 
| eval source="source1/log.log" 
| rex field=source mode=sed "s/^[a-zA-Z]+(\d+)\/.*/sourcegroup\1/g"
0 Karma

starcher
Influencer

example

| makeresults 
| eval source="source1/log.log" 
| rex field=source "^(?P<source_group>[^\/]+)" 
| fields - source
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...