Splunk Search

Field Extraction

aknsun
Path Finder

Need some suggestion for field extraction.

Take this as an example:
I have a file path /opt/splunk/var/log/splunk/splunkd.log

There is already a field extraction done for this called file_name.

I would like to do a filed extraction with just the Directory path ( /opt/splunk/var/log/splunk/) and name dir_name.

The problem arises when I try to do a new extraction, as the path is sort of already used by file_name and splunk mentions that I need "To highlight text that is already part of an existing extraction, first turn off the existing extractions"

My doubt here is. If I turn of the existing extraction and then create one for dir_name, would I still be able to use file_name or does that get over-ridden by the new extraction?

Thanks,
AKN

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval file_name="/opt/splunk/var/log/splunk/splunkd.log" 
| rex field=file_name "(?<dir_name>\/.*\/)"

Hi, how about this?

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval path="/opt/splunk/var/log/splunk/splunkd.log" 
| rex field=path "(^(?P<dir_name>.+)\/)([^\/]+)$"

or

| makeresults 
| eval path="/opt/splunk/var/log/splunk/splunkd.log" 
| eval dir_name=replace(path,"(\/[^\/]+)$","")
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...