Splunk Search

Extract a file name from the splunk logs

kumarnis45
Path Finder

Hi team,

     I am new to the splunk. I am just running a splunk query with an ID name to get the file assocaited with it from the logs. Event logs are looks below from the splunk,

Logs:

  the log files are

   RequestId: abcd File uploaded to: s3://test/sample/file.json

  source: source name

  host: host name

  etc

 

how can i run a query to search splunk event logs and look for .JSON file and return the full JSON file name?

Any help is appreciated.

 

Thanks.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The rex command uses regular expressions (regex) rather than patterns.  Whereas in a pattern "*" means "any number of any thing", in regex it means "repeat the last character any number of times".  It's a subtle, but meaningful difference.

This should help.  Note the escaped slashes.

| rex "uploaded to: s3:\/\/.*?-sample-.*?-us-east-1-s3\/path\/(?<filename>.*)"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

kumarnis45
Path Finder

Thanks Rich. That worked

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's a basic query that should get you started. 

index=foo "uploaded to"
| rex "uploaded to: (?<filepath>.*)"
| table filepath
---
If this reply helps you, Karma would be appreciated.

kumarnis45
Path Finder

hi @richgalloway ,

 

  Thanks for replying to my post. Yes, this query really helps me and get the file name i need. One question is that, values in URL names are dynamic and changes with environment (dev, qa,  uat etc) and client name (client1, client2 etc). How can i over come that?

The command that working for me for static values in URL:

rex "uploaded to: s3://<client>-sample-<env>-us-east-1-s3/path/(?<filename>.*)" | table filename

 

In above command, client(client1, client2 and client3) and env(dev, qa and uat) values changes. How can i over come that?

 If i pass '*' for the env and client names query not returning anything.

 

Thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rex command uses regular expressions (regex) rather than patterns.  Whereas in a pattern "*" means "any number of any thing", in regex it means "repeat the last character any number of times".  It's a subtle, but meaningful difference.

This should help.  Note the escaped slashes.

| rex "uploaded to: s3:\/\/.*?-sample-.*?-us-east-1-s3\/path\/(?<filename>.*)"

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...