Getting Data In

source name setup with wildcard

SS1
Path Finder

Hi Everyone,

Currently i am monitoring the *.log files under a path, i have not given a source name since we dont have a definite source The file names keep on updating

My Inputs.conf

[monitor://[path]\*.log]
disabled = 0
index = test
sourcetype = sourcetypetest

When the data is indexed into splunk, it is giving the source names as "E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log'' where as i just want to extract the 'user-MemoCPU' field in the source and display in a dashboard panel. Please let me know if its possible

I am building a dashboard panel with below query,

index = test | stats count by source | sort -count

 

 

Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

Yes, 
For the first one just extract the user part:

index = test | rex field=source "\\\\(?<source>\w+)-\w+.log$" | stats count by source | sort -count

 

For the second one:

index = test | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | table source, issue

 

If this reply helps you, an upvote/like would be appreciated.

 

View solution in original post

SS1
Path Finder

Thanks, this worked like a charm.

output is shown as below

source                       count

user-MemoCPU        1

 

Is there a way i can show output as just like below

source                       count

user       1

or

source                       issue

user                       MemoCPU        

 

 

 

0 Karma

manjunathmeti
Champion

Yes, 
For the first one just extract the user part:

index = test | rex field=source "\\\\(?<source>\w+)-\w+.log$" | stats count by source | sort -count

 

For the second one:

index = test | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | table source, issue

 

If this reply helps you, an upvote/like would be appreciated.

 

SS1
Path Finder

Thanks a lot, both working fine !

0 Karma

manjunathmeti
Champion

You are welcome! Upvotes will be appreciated!

0 Karma

manjunathmeti
Champion

You can use rex to extract the only filename:

index = test | rex field=source "(?<source>[^\\\\]+)\.log$" | stats count by source | sort -count

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...