Getting Data In

How to change the name of the source path that is being shown in the results?

diabinho
Explorer

I have a search that gives me two groups separated by two different sources but I do not want to have the source path showing, I want to rename it, how can I do that?

For example, to show sourcegroup1 and sourcegroup2?

alt text

Thanks

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=source mode=sed "s/\/.*$//"
0 Karma

arjunpkishore5
Motivator

Multiple ways to approach this

If your list is small, you can use a simple case statement

| eval source=case(match(source, "source1"), "sourcegroup1", match(source, "source2"), "sourcegroup2")

If your list is larger, use a lookup file with the mappings

| lookup <lookupfile> <source-old> as source OUTPUT <source-new >as source

Need to extract part of your source as the new source? refer to the rex examples provided by @starcher and @mayurr98

Case - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions
Lookup - https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Lookup

diabinho
Explorer

@arjunpkishore5 it almost did the trick, the first approach. But now it does show anything. I get the column "source" but nothing on each line (no sourcegroup1 or sourcegroup2).

Thanks

0 Karma

arjunpkishore5
Motivator

Is the value of source in mixed case? As in , has both upper and lower case characters?

0 Karma

diabinho
Explorer

Yes they do, in both sources.

0 Karma

arjunpkishore5
Motivator

in that case, please change the case statement to the following.

| eval source=case(match(lower(source), "source1"), "sourcegroup1", match(lower(source), "source2"), "sourcegroup2")

match is case sensitive. so I'm force converting the value to lower case so that they match to the lowercase pattern

0 Karma

diabinho
Explorer

Didnt work, keep getting them in blank.

0 Karma

arjunpkishore5
Motivator

Hi, I was away for a few days. Is your issue resolved now ?

0 Karma

mayurr98
Super Champion

Try this:

| makeresults 
| eval source="source1/log.log" 
| rex field=source mode=sed "s/^[a-zA-Z]+(\d+)\/.*/sourcegroup\1/g"
0 Karma

starcher
SplunkTrust
SplunkTrust

example

| makeresults 
| eval source="source1/log.log" 
| rex field=source "^(?P<source_group>[^\/]+)" 
| fields - source
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...