Splunk Enterprise

How to extract specific filename from the lookup ?

Ashwini008
Communicator

I have the following lookup and have to extract only the bold part which is my filename.

inputLookupname -Trans.log

Tue Feb 23 11:12:54 IST 2021 - trans_file.sh zouttime.gcaswb8o.600 starts
202102231112: /satn/PRY/qoutsa/zpittime.gcaswb8o.600.20210223111125 was moved to INPUT
Tue Feb 23 11:12:54 IST 2021 - trans_file.sh zxtytime.glk1a03o.600 starts
202102231112: /satn/PRY/qoutsa/zpittime.gov1a03o.600.20210223105623 was moved to INPUT

 

How do i capture only the the filename which is in bold?

Tags (4)
0 Karma

manjunathmeti
Champion

Looks like this is in the index, you can use rex command to extract highlighted text in a field myfield.

| rex "\.sh\s(?<myfield>[^\s]+)"

 

If this reply helps you, an upvote/like would be appreciated.

Ashwini008
Communicator

@manjunathmeti Thank you. It worked. Can you tell me how the  expression is working basically? Like if there any basic rules on understanding regex expression or how it works!

0 Karma

manjunathmeti
Champion
\.sh matches the character .sh literally 
\s matches any whitespace character.
 
Named Capture Group myfield 
(?<myfield>[^\s]+)
Match a single character not present in the list below 
[^\s]+
+ Quantifier — Matches between one and unlimited times, as many times as possible, giving back as needed (greedy)
[^\s]+ matches 1 or more characters except whitespace. So it will match all the characters before space.

Ashwini008
Communicator

@manjunathmeti Great. Adding to that. I have below filename where i need to capture only the bold part.But all these files are in the same location.i cannot use single regex that applies to all the below file format.

How do i proceed on capturing the required format?

worldtime.xml.1
ztymp.txt.1
molu.dat.1
jss_pyuroly_7.dat.1
zpiyzygh.rtnugbhti.1
AD.CD.MBOUDN.1
DM.DEVT.IYP.IN.1
in_zpiyrmlu.rage.600.1.txt.1
in_soledt.pou.til.ssn.gpg.1.txt.1

zprunsledSCALLb1.prn.1

0 Karma