Getting Data In

How to list all the values which are greater than or equal to three after splitting?

bollam
Path Finder

I have following values for a field="Listdir". I want to get the only the values which contains 3 or more directories.

/opt/test/class/
/opt/
/opt/test/learn/
/opt/test/
/opt/test/class/file/
/opt/
/opt/test/class/file/location/users/
/opt/test/class/
/opt/test/class/bin/
/opt/

The output should look like below:
/opt/test/class/
/opt/test/learn/
/opt/test/class/file/
/opt/test/class/file/location/users/
/opt/test/class/bin/

Tags (2)
0 Karma

HiroshiSatoh
Champion

How's this?

ex)
    | makeresults |eval text="/opt/test/class/file/location/users/"
    |eval result=split(text ,"/"),count=mvcount(result)
    |where count>3
0 Karma

knielsen
Contributor

You could filter with the regex command maybe.

run all example:
| makeresults
| eval Listdir="/opt/test/class/#/opt/#/opt/test/learn/#/opt/test/class/file/#/opt/#/opt/test/class/file/location/users/"
| makemv delim="#" Listdir | mvexpand Listdir
| regex Listdir="(\/[^\/]+){3}/*"

So the last line is the actual filter, the rest was to test it. 🙂

Hth,
-Kai.

0 Karma

bollam
Path Finder

@knielsen Thanks for the quick response!! Actually, The field contains dynamic values and values are more than 100, How do I get results in the case where we do not know the exact values of field "Listdir"? I need to filter out the values which contains more than 3 directories from all the values of the field "Listdir".

0 Karma

knielsen
Contributor

Well, this should work already for any list. The filter is "(\/[^\/]+){3}/*" regardless of the directory names, I just filtered for anything that has at least three leading sections with "/...".

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...