source name setup with wildcard

[SS1]

Hi Everyone,

Currently i am monitoring the *.log files under a path, i have not given a source name since we dont have a definite source The file names keep on updating

My Inputs.conf

[monitor://[path]\*.log]
disabled = 0
index = test
sourcetype = sourcetypetest

When the data is indexed into splunk, it is giving the source names as "E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log'' where as i just want to extract the 'user-MemoCPU' field in the source and display in a dashboard panel. Please let me know if its possible

I am building a dashboard panel with below query,

index = test | stats count by source | sort -count

[SS1]

Thanks, this worked like a charm.

output is shown as below

source                       count

user-MemoCPU        1

Is there a way i can show output as just like below

source                       count

user       1

or

source                       issue

user                       MemoCPU        

[manjunathmeti · Accepted solution]

Yes, 
For the first one just extract the user part:

index = test | rex field=source "\\\\(?<source>\w+)-\w+.log$" | stats count by source | sort -count

For the second one:

index = test | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | table source, issue

If this reply helps you, an upvote/like would be appreciated.

[SS1]

Thanks a lot, both working fine !

[manjunathmeti]

You are welcome! Upvotes will be appreciated!

[manjunathmeti]

You can use rex to extract the only filename:

index = test | rex field=source "(?<source>[^\\\\]+)\.log$" | stats count by source | sort -count

If this reply helps you, an upvote/like would be appreciated.