Getting Data In

How to create a field from values with the source field?

vishalduttauk
Communicator

I've created fields from regex expressions before but never from the source field.

This is an example of the value within the source field:
 \\host0000\Test\IT Information\ Data Files\Daily Reporting\Business Unit\ 

I would like to extract the business unit value and call it Business Unit.

I have access to create a props.conf file.

 

Can you help?

 

Kind regards,

Vishal

Labels (1)
0 Karma
1 Solution

vsommer
Explorer

Hello Vishal,

is the folder structure always the same? If yes, this should work:

| rex field=source "Daily Reporting\\(?<business_unit>[^\\]+)"

If not you could use this regex:

\\\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\(?<business_unit>[^\\]+)

 

If you want to include this to props.conf and transforms.conf try something like this:

props.conf

[sourcetype]
REPORT-my_fields = business_unit

transforms.conf

[business_unit]
SOURCE_KEY = source
REGEX = one of the above mentioned regex

 

If this helps please upvote my answer.

Best regards,

Vincent

View solution in original post

vsommer
Explorer

Hello Vishal,

is the folder structure always the same? If yes, this should work:

| rex field=source "Daily Reporting\\(?<business_unit>[^\\]+)"

If not you could use this regex:

\\\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\(?<business_unit>[^\\]+)

 

If you want to include this to props.conf and transforms.conf try something like this:

props.conf

[sourcetype]
REPORT-my_fields = business_unit

transforms.conf

[business_unit]
SOURCE_KEY = source
REGEX = one of the above mentioned regex

 

If this helps please upvote my answer.

Best regards,

Vincent

gcusello
SplunkTrust
SplunkTrust

Hi @vishalduttauk,

if the number ot subfolders in path is fixed you can use this regex in a search:

| rex field=source "\\(\\[^\\]+){5}\\(?<business_unit>[^\\]+)"

if instead you want to use this regex in a field extraction, you can use:

\\(\\[^\\]+){5}\\(?<business_unit>[^\\]+) in source

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...