I would like to use field extraction at search time to do the following:
My source field in Splunk contains file paths. Each file path has a word that I want to extract from it and place into another field.
E.g. Source field contains a file path \helloworld\welcome\TheWord-uvwxyz.1234.log The word I want to extract is uvwxyz.
How can I achieve this? Is there a way of doing this using props.conf and/or transforms.conf?
N.B. I do not want to extract data from _raw but from the field named source.
Thanks in advance for your help
This will be easier to deal with if you define a permanent extraction.
[extract-filename] SOURCE_KEY = source REGEX = TheWord-([^\.]+) FORMAT = filename::$1
[yoursourcetype] REPORT-filename = extract-filename
Tweak the regex to your liking. Change the
[yoursourcetype] heading to
[source::yoursource] as needed.
The fact that you are extracting from
source is something of a special case, since you can be sure of having that field already populated in the index.
If your first field is not
sourcetype, then you also need to make sure that your field extractions are called in the correct order -- naming becomes important. For example
In My case i use this:
... | rex field=source "basefolder\\\\(?<path>(\w+\\\\)+)(?<filename>.*).log" |
Obtaining both the filepath and the filename. For your example I'd do:
... | rex field=source "helloworld\\\\(?<path>(\w+\\\\)+)TheWord-(?<filename>.*).log" |