Field transformation on source not working

[archananaveen]

Hi There,

There is no content in dummy field although the regex works fine. Please could you help me with this?

Type: Regex-based
Regular expression: "(\/\w+){2}\/(?.?)\/"

Tried "(\/\w+){2}\/(?.?)\/" in source

Source Key: source

Checked create multi valued fields.

same source field content is as below:
/folder1/folder2/SAMPLE1/Test.log
/folder1/folder2/SAMPLE2/Test.log

[archananaveen]

This worked after | extract reload=true. However, output is displayed at times and doesn't show any at other times. Is there any way to extend the search time or what is the alternative way to fix this problem?
index = * sourcetype=xxxx| dedup pathName | sort pathName | table pathName

[richgalloway]

There may be typos in your regular expressions. Please edit your question and put the regex strings inside backtics ('`') so all characters are preserved.

[archananaveen]

Regular expression inside the brackets: ('(\/\w+){2}\/(?.*?)\/')

In other blogs there is a mention of adding fields to *.conf's I do not have access for all those. Is there any workaround with UI Field transformers ?

[richgalloway]

That regex has an error in it. The leading question mark in the "(?.*?)" bit is out of place. Perhaps it's supposed to be field extraction? If so, putting the entire regex inside back ticks will make it visible (or highlight it and click the "101010" button.

[archananaveen]

Here is the regex

https://regex101.com/r/UnBcR4/1

[richgalloway]

Have you tried this alternative regex (\/\w+){2}\/(?<dummy>[^\/]*)\/?

[archananaveen]

this is not working, is there any different method to display the output of this transformation ?

[richgalloway]

The /opt/splunk/bin/pcregextest command will show how Splunk is interpreting your regex string, which is likely to be different from web pages like regex101.com.

What is the context for this regex? Can you share the stanza in which it is used?