Splunk Search

Extracting filename from verbose message

gravi
Explorer

I am trying to write a splunk query to create a dashboard.

I have message from where I need particular part as filename

"Copying the file : /mount/logs/output/fileName.xml to : /mount/splunk/fileName.xml.pgp is started"

I need the part fileName.xml.pgp from the above message, how do I achieve this?

Thanks

0 Karma

mayurr98
Super Champion

try this:

index=<your_index> | rex "\/splunk\/(?<filename>[^\s]+)"

If it's not working then please give more sample inputs. This solution is on the assumption that it always follows the path /splunk/filename

0 Karma

richgalloway
SplunkTrust
SplunkTrust

rex to the rescue!

... | rex "to\s:\s.*\/(<filename>\S+)"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...