Splunk Dev

How to extract a string and display it as filename

ugramkonda
New Member

I have a log File as follows
07:30:57.222 02/20/2017 File "SKU_DR2_DBF_FULL_20170220_122856.csv" is received from FTP server "209.55.186.211"

Now, I need to extract the file name as SKU_DR2_DBF_FULL_20170220_122856 except the .csv Someone please help me on this.

Tags (1)
0 Karma

ugramkonda
New Member

Instead of this I have worked with IFX in Splunk

0 Karma

adayton20
Contributor

Try this:

| rex field=_raw "File\s\"(?P<file>.[^\"]*)"
0 Karma

DalJeanis
Legend

I thought the same thing, but see OPs "expected output is..."

richgalloway's answer is correct for that expected output.

0 Karma

adayton20
Contributor

Oops. I didn't see he didn't want the file extension :face_with_tongue:

0 Karma

ugramkonda
New Member

Expected Output is:

File 

SKU_DR2_DBF_FULL_20170220_122856

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | rex "File \"(?<file>[^\.]+)" | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...