Validating the file name in splunk

[mahbs]

Hi,

I was just wondering, is there a way to validate the name of the file that is being ingested into splunk?

So for example, if the file name is: "filename 20180124" I would have thought a regular expression could be used to validate that, but the question is, how do I use a query to display the file name into the console and then validate it?

Could someone shed some light on this?

Thanks

[FrankVl]

Is the filename in the source field (as usual)?

Then you could do something like:

...base search...
| eval validFileName=(if(match(source,"<validation regex>"),"Yes", "No"))

[mayurr98]

are you looking for a list of file names that are been index by Splunk?

[mahbs]

Hey @mayurr98, not a list, but I've created dashboards per file. The Splunk picks up the file from the splunk server and ingests it. For that file that is being picked up, in that dashboard, I want to create a panel that basically checks to see if the file name conforms to the intended design