Getting Data In

How to create a field from values with the source field?

vishalduttauk
Communicator

I've created fields from regex expressions before but never from the source field.

This is an example of the value within the source field:
 \\host0000\Test\IT Information\ Data Files\Daily Reporting\Business Unit\ 

I would like to extract the business unit value and call it Business Unit.

I have access to create a props.conf file.

 

Can you help?

 

Kind regards,

Vishal

Labels (1)
0 Karma
1 Solution

vsommer
Explorer

Hello Vishal,

is the folder structure always the same? If yes, this should work:

| rex field=source "Daily Reporting\\(?<business_unit>[^\\]+)"

If not you could use this regex:

\\\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\(?<business_unit>[^\\]+)

 

If you want to include this to props.conf and transforms.conf try something like this:

props.conf

[sourcetype]
REPORT-my_fields = business_unit

transforms.conf

[business_unit]
SOURCE_KEY = source
REGEX = one of the above mentioned regex

 

If this helps please upvote my answer.

Best regards,

Vincent

View solution in original post

vsommer
Explorer

Hello Vishal,

is the folder structure always the same? If yes, this should work:

| rex field=source "Daily Reporting\\(?<business_unit>[^\\]+)"

If not you could use this regex:

\\\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\(?<business_unit>[^\\]+)

 

If you want to include this to props.conf and transforms.conf try something like this:

props.conf

[sourcetype]
REPORT-my_fields = business_unit

transforms.conf

[business_unit]
SOURCE_KEY = source
REGEX = one of the above mentioned regex

 

If this helps please upvote my answer.

Best regards,

Vincent

gcusello
SplunkTrust
SplunkTrust

Hi @vishalduttauk,

if the number ot subfolders in path is fixed you can use this regex in a search:

| rex field=source "\\(\\[^\\]+){5}\\(?<business_unit>[^\\]+)"

if instead you want to use this regex in a field extraction, you can use:

\\(\\[^\\]+){5}\\(?<business_unit>[^\\]+) in source

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...