Splunk Search

Extracting File Type

behymejt2012
Path Finder

Hi Everyone,

Trying to extract the File Type from Files (ex: pst, xml, etc). I have tried to split it:

eval split =Split(File,".") | eval type=mvindex(split,1)

But a problem occurs when files like: "2012-12-08 15.36.01.jpg" show up due to the extra "." in the file name.

Is there any recommended rex, or method that can be used to pull the file type from the end of the File name instead of trying to split everything up.

Thanks

Tags (1)
0 Karma
1 Solution

Ayn
Legend

If you read the docs, they have the following to say about the mvindex command:

For mvindex(mvfield, startindex, [endindex]), endindex is inclusive and optional; both startindex and endindex can be negative, where -1 is the last element.

So, eval type=mvindex(split,-1) should do the trick.

Otherwise, if you want a rex solution, you could do

... | rex field=File "(?<type>[^.]+)$"

View solution in original post

Ayn
Legend

If you read the docs, they have the following to say about the mvindex command:

For mvindex(mvfield, startindex, [endindex]), endindex is inclusive and optional; both startindex and endindex can be negative, where -1 is the last element.

So, eval type=mvindex(split,-1) should do the trick.

Otherwise, if you want a rex solution, you could do

... | rex field=File "(?<type>[^.]+)$"

Ayn
Legend

Sorry, like it says - you need to include a group name at the beginning. I updated my answer with correct syntax.

0 Karma

behymejt2012
Path Finder

Thanks,

When I try and use the rex I get the following error (havent really used rex): "Error in 'rex' command: The regex '([^.]+)$' does not extract anything. It should specify at least one named group. Format: (?...)."

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...