Extraction of extension from filename and flagging them

[Jananee_iNautix]

I have to do something like according to the extension of the filename that i extract from logs i want to flag them.
For example if filename is of.txt extension I should flag them as T.How can i do that in splunk?can anyone help me on this.

I should get the following result
filename flag
abc.txt T

[linu1988]

Hello,
If you mean to say the first letter after the extension starts then below will do it,

source=..| rex field=filename "\\.(?<Flag>\S+)"|eval Flag=upper(Flag)|eval Flag=case(Flag="ZIP", "C", Flag="TAR", "T", Flag="CSV" OR Flag="TXT" OR Flag="PDF" , "U")|table filename,Flag

Thanks

[linu1988]

As Somesh suggested you need to get a lookup which will get you the FLAG details. Alternative is to use a case/if statement. Have updated the query

[Jananee_iNautix]

i want to get the result like if the file is with.ZIP extension display as "c",with .tar extension display "t",else for all other things display as "u".Can you give search query for this.
filename flag
asd.ZIP c
fefew.tar t
werw.csv u
ew.txt u
fgwe.pdf u

[somesoni2]

And if not just always the first letter of the file extension, then you should create a lookup table file with file extension to flag mapping and then do a lookup.

source=..| rex field=filename "\\.(?.*)" | lookup File_Extension OUTPUT Flag