splunk rename source

[SS1]

I have my source name as below, the 'user' field keeps on updating

E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log

I don't want to display the entire path but just want user-MemoCPU as source, can we achieve it?

[manjunathmeti]

You can extract using rex command:

| makeresults 
| eval source="E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log" 
| rex field=source "(?<source>[^\\\\]+)\.log$"

If this reply helps you, an upvote/like would be appreciated.