Getting Data In

How to list all the values which are greater than or equal to three after splitting?

bollam
Path Finder

I have following values for a field="Listdir". I want to get the only the values which contains 3 or more directories.

/opt/test/class/
/opt/
/opt/test/learn/
/opt/test/
/opt/test/class/file/
/opt/
/opt/test/class/file/location/users/
/opt/test/class/
/opt/test/class/bin/
/opt/

The output should look like below:
/opt/test/class/
/opt/test/learn/
/opt/test/class/file/
/opt/test/class/file/location/users/
/opt/test/class/bin/

Tags (2)
0 Karma

HiroshiSatoh
Champion

How's this?

ex)
    | makeresults |eval text="/opt/test/class/file/location/users/"
    |eval result=split(text ,"/"),count=mvcount(result)
    |where count>3
0 Karma

knielsen
Contributor

You could filter with the regex command maybe.

run all example:
| makeresults
| eval Listdir="/opt/test/class/#/opt/#/opt/test/learn/#/opt/test/class/file/#/opt/#/opt/test/class/file/location/users/"
| makemv delim="#" Listdir | mvexpand Listdir
| regex Listdir="(\/[^\/]+){3}/*"

So the last line is the actual filter, the rest was to test it. 🙂

Hth,
-Kai.

0 Karma

bollam
Path Finder

@knielsen Thanks for the quick response!! Actually, The field contains dynamic values and values are more than 100, How do I get results in the case where we do not know the exact values of field "Listdir"? I need to filter out the values which contains more than 3 directories from all the values of the field "Listdir".

0 Karma

knielsen
Contributor

Well, this should work already for any list. The filter is "(\/[^\/]+){3}/*" regardless of the directory names, I just filtered for anything that has at least three leading sections with "/...".

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...