taking the source file path and creating a field

[sbattista09]

if i wanted to take the app_name from the path of the source and create a field via the CLI of the input how would i do that? I know i could rename the source type however, that is not a option. I want to create a new field based off the 4th position of the source path.

source = /foo/app/test/app/app_name/logs/log.log

[woodcock]

Like this:

 ... | rex field=source "^\/(?:[^\/]+\/){3}(?<app_name>[^\/]+)\/"

[rphillips_splk · Accepted solution]

You can setup in props.conf of the search head:

example with source stanza:

[source::/opt/log/*/logs]
EXTRACT-inSource = /opt/log/(?<field1>[^/]+)/logs/.* in source

example with sourcetype stanza:

[mysourcetype]
EXTRACT-inSource = /opt/log/(?<field1>[^/]+)/logs/.* in source

[sbattista09]

This works well, one last question is, what is the syntax for extracting more fields in source?

putting in in like this only works with the foofoo extraction-
[sourcetypename]
EXTRACT-inSource = ^\/[^\/]+\/[^\/]+\/(?[^\/]+)\/ in source
EXTRACT-inSource = ^\/[^\/]+\/[^\/]+\/[^\/]+\/(?[^\/]+)\/ in source
EXTRACT-inSource = ^\/[^\/]+\/[^\/]+\/[^\/]+\/[^\/]+\/(?[^\/]+)\/ in source

[sbattista09]

I don't want to do this via a inline search.

[DalJeanis]

...then combine rphillips suggestion with either mine or woodcock's - use one of our rex codes, with rphillips' suggestion of where to do it.

[DalJeanis]

use...

| rex field=source "^\/[^\/]+\/[^\/]+\/[^\/]+\/(?<myfield>[^\/]+)\/"

...or ...

| rex field=source "^\/[^\/]+\/[^\/]+\/[^\/]+\/[^\/]+\/(?<myfield>[^\/]+)\/"

...depending on whether your "fourth" was zero-based or one-based.