Getting Data In

How to create a field from values with the source field?

vishalduttauk
Communicator

I've created fields from regex expressions before but never from the source field.

This is an example of the value within the source field:
 \\host0000\Test\IT Information\ Data Files\Daily Reporting\Business Unit\ 

I would like to extract the business unit value and call it Business Unit.

I have access to create a props.conf file.

 

Can you help?

 

Kind regards,

Vishal

Labels (1)
0 Karma
1 Solution

vsommer
Explorer

Hello Vishal,

is the folder structure always the same? If yes, this should work:

| rex field=source "Daily Reporting\\(?<business_unit>[^\\]+)"

If not you could use this regex:

\\\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\(?<business_unit>[^\\]+)

 

If you want to include this to props.conf and transforms.conf try something like this:

props.conf

[sourcetype]
REPORT-my_fields = business_unit

transforms.conf

[business_unit]
SOURCE_KEY = source
REGEX = one of the above mentioned regex

 

If this helps please upvote my answer.

Best regards,

Vincent

View solution in original post

vsommer
Explorer

Hello Vishal,

is the folder structure always the same? If yes, this should work:

| rex field=source "Daily Reporting\\(?<business_unit>[^\\]+)"

If not you could use this regex:

\\\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\(?<business_unit>[^\\]+)

 

If you want to include this to props.conf and transforms.conf try something like this:

props.conf

[sourcetype]
REPORT-my_fields = business_unit

transforms.conf

[business_unit]
SOURCE_KEY = source
REGEX = one of the above mentioned regex

 

If this helps please upvote my answer.

Best regards,

Vincent

gcusello
SplunkTrust
SplunkTrust

Hi @vishalduttauk,

if the number ot subfolders in path is fixed you can use this regex in a search:

| rex field=source "\\(\\[^\\]+){5}\\(?<business_unit>[^\\]+)"

if instead you want to use this regex in a field extraction, you can use:

\\(\\[^\\]+){5}\\(?<business_unit>[^\\]+) in source

Ciao.

Giuseppe

Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...