Splunk Search

Extract a file name from the splunk logs

kumarnis45
Path Finder

Hi team,

     I am new to the splunk. I am just running a splunk query with an ID name to get the file assocaited with it from the logs. Event logs are looks below from the splunk,

Logs:

  the log files are

   RequestId: abcd File uploaded to: s3://test/sample/file.json

  source: source name

  host: host name

  etc

 

how can i run a query to search splunk event logs and look for .JSON file and return the full JSON file name?

Any help is appreciated.

 

Thanks.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The rex command uses regular expressions (regex) rather than patterns.  Whereas in a pattern "*" means "any number of any thing", in regex it means "repeat the last character any number of times".  It's a subtle, but meaningful difference.

This should help.  Note the escaped slashes.

| rex "uploaded to: s3:\/\/.*?-sample-.*?-us-east-1-s3\/path\/(?<filename>.*)"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

kumarnis45
Path Finder

Thanks Rich. That worked

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's a basic query that should get you started. 

index=foo "uploaded to"
| rex "uploaded to: (?<filepath>.*)"
| table filepath
---
If this reply helps you, Karma would be appreciated.

kumarnis45
Path Finder

hi @richgalloway ,

 

  Thanks for replying to my post. Yes, this query really helps me and get the file name i need. One question is that, values in URL names are dynamic and changes with environment (dev, qa,  uat etc) and client name (client1, client2 etc). How can i over come that?

The command that working for me for static values in URL:

rex "uploaded to: s3://<client>-sample-<env>-us-east-1-s3/path/(?<filename>.*)" | table filename

 

In above command, client(client1, client2 and client3) and env(dev, qa and uat) values changes. How can i over come that?

 If i pass '*' for the env and client names query not returning anything.

 

Thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rex command uses regular expressions (regex) rather than patterns.  Whereas in a pattern "*" means "any number of any thing", in regex it means "repeat the last character any number of times".  It's a subtle, but meaningful difference.

This should help.  Note the escaped slashes.

| rex "uploaded to: s3:\/\/.*?-sample-.*?-us-east-1-s3\/path\/(?<filename>.*)"

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...