Splunk Dev

Validating the file name in splunk

Path Finder


I was just wondering, is there a way to validate the name of the file that is being ingested into splunk?

So for example, if the file name is: "filename 20180124" I would have thought a regular expression could be used to validate that, but the question is, how do I use a query to display the file name into the console and then validate it?

Could someone shed some light on this?


Tags (1)
0 Karma

Ultra Champion

Is the filename in the source field (as usual)?

Then you could do something like:

...base search...
| eval validFileName=(if(match(source,"<validation regex>"),"Yes", "No"))
0 Karma

Super Champion

are you looking for a list of file names that are been index by Splunk?

0 Karma

Path Finder

Hey @mayurr98, not a list, but I've created dashboards per file. The Splunk picks up the file from the splunk server and ingests it. For that file that is being picked up, in that dashboard, I want to create a panel that basically checks to see if the file name conforms to the intended design

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...