Splunk Dev

How to extract a string and display it as filename

ugramkonda
New Member

I have a log File as follows
07:30:57.222 02/20/2017 File "SKU_DR2_DBF_FULL_20170220_122856.csv" is received from FTP server "209.55.186.211"

Now, I need to extract the file name as SKU_DR2_DBF_FULL_20170220_122856 except the .csv Someone please help me on this.

Tags (1)
0 Karma

ugramkonda
New Member

Instead of this I have worked with IFX in Splunk

0 Karma

adayton20
Contributor

Try this:

| rex field=_raw "File\s\"(?P<file>.[^\"]*)"
0 Karma

DalJeanis
Legend

I thought the same thing, but see OPs "expected output is..."

richgalloway's answer is correct for that expected output.

0 Karma

adayton20
Contributor

Oops. I didn't see he didn't want the file extension 😛

0 Karma

ugramkonda
New Member

Expected Output is:

File 

SKU_DR2_DBF_FULL_20170220_122856

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | rex "File \"(?<file>[^\.]+)" | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...