Extract a file name from the splunk logs

[kumarnis45]

Hi team,

     I am new to the splunk. I am just running a splunk query with an ID name to get the file assocaited with it from the logs. Event logs are looks below from the splunk,

Logs:

  the log files are

   RequestId: abcd File uploaded to: s3://test/sample/file.json

  source: source name

  host: host name

  etc

how can i run a query to search splunk event logs and look for .JSON file and return the full JSON file name?

Any help is appreciated.

Thanks.

[kumarnis45]

Thanks Rich. That worked

[richgalloway]

Here's a basic query that should get you started. 

index=foo "uploaded to"
| rex "uploaded to: (?<filepath>.*)"
| table filepath

[kumarnis45]

hi @richgalloway ,

  Thanks for replying to my post. Yes, this query really helps me and get the file name i need. One question is that, values in URL names are dynamic and changes with environment (dev, qa,  uat etc) and client name (client1, client2 etc). How can i over come that?

The command that working for me for static values in URL:

rex "uploaded to: s3://<client>-sample-<env>-us-east-1-s3/path/(?<filename>.*)" | table filename

In above command, client(client1, client2 and client3) and env(dev, qa and uat) values changes. How can i over come that?

 If i pass '*' for the env and client names query not returning anything.

Thanks.

[richgalloway · Accepted solution]

The rex command uses regular expressions (regex) rather than patterns.  Whereas in a pattern "*" means "any number of any thing", in regex it means "repeat the last character any number of times".  It's a subtle, but meaningful difference.

This should help.  Note the escaped slashes.

| rex "uploaded to: s3:\/\/.*?-sample-.*?-us-east-1-s3\/path\/(?<filename>.*)"