Splunk Search

Field Extraction

aknsun
Path Finder

Need some suggestion for field extraction.

Take this as an example:
I have a file path /opt/splunk/var/log/splunk/splunkd.log

There is already a field extraction done for this called file_name.

I would like to do a filed extraction with just the Directory path ( /opt/splunk/var/log/splunk/) and name dir_name.

The problem arises when I try to do a new extraction, as the path is sort of already used by file_name and splunk mentions that I need "To highlight text that is already part of an existing extraction, first turn off the existing extractions"

My doubt here is. If I turn of the existing extraction and then create one for dir_name, would I still be able to use file_name or does that get over-ridden by the new extraction?

Thanks,
AKN

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval file_name="/opt/splunk/var/log/splunk/splunkd.log" 
| rex field=file_name "(?<dir_name>\/.*\/)"

Hi, how about this?

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval path="/opt/splunk/var/log/splunk/splunkd.log" 
| rex field=path "(^(?P<dir_name>.+)\/)([^\/]+)$"

or

| makeresults 
| eval path="/opt/splunk/var/log/splunk/splunkd.log" 
| eval dir_name=replace(path,"(\/[^\/]+)$","")
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...