Splunk Search

Fields with and without spaces

kmattern
Builder

On my portal I have Solaris web logs from which I must extract file names that were downloaded by the end user. These files come from many different sources, individuals and companies. Sometimes the filenames have spaces in them and sometimes they do not. They are intermixed in the logs.

These filenames have spaces in them:

/krbox/resources/SW CH 32 0 2012-11-16.pdf
/krbox/system/platform/krbox304b/Attachment 4 111026M123B.pdf
/krbox/system/platform/krbox304b/Attachment 1 111026M121C-704.pdf
/krbox/system/platform/krbox304b/Attachment 6 Functional Test Logs.zip

While these do not:

/krbox/reference/publications/XARP/cnf/tb11-5895-1893-13.pdf
/krbox/system/platform/krbox304b/Attachment_7_D0206-001_KRBOX-304B_RS1Testing.pdf
/krbox/system/platform/krbox304b/Attachment_1_111026M121C-704.pdf

This is how they might look in the actual log:

/krbox/reference/publications/XARP/cnf/tb11-5895-1893-13.pdf
/krbox/resources/SW CH 32 0 2012-11-16.pdf
/krbox/system/platform/krbox304b/Attachment_7_D0206-001_KRBOX-304B_RS1Testing.pdf
/krbox/system/platform/krbox304b/Attachment 1 111026M121C-704.pdf
/krbox/system/platform/krbox304b/Attachment 6 Functional Test Logs.zip
/krbox/system/platform/krbox304b/Attachment_1_111026M121C-704.pdf
/krbox/system/platform/krbox304b/Attachment 4 111026M123B.pdf

I normally use the slash “/” as the delimiter in multi value fields to extract the filename. How can I extract the filenames regardless of the spaces?

0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

This extraction works at search time. In this case we capture anything at the end of the string ($) and the slash (/) delimiter.

sourcetype="answers-1370378440" | rex field=_raw "/(?< filename>[a-zA-Z0-9\s_\.-]+)$"

If the sample data is partial and you have the file name as a whole in a field, called filename, then you would use it like this:

sourcetype="answers-1370378440" | rex field=filename "/(?< filename>[a-zA-Z0-9\s_\.-]+)$"

And, of course you can automate this with an entry in props.conf:

[answers-1370378440]
EXTRACT-filename = /(?< filename>[a-zA-Z0-9\s_\.-]+)$

PS: There is a space in <filename> due to the markup.

0 Karma

bmacias84
Champion

Due to the complexity of the field you will have to use regex. You can use a transform, inline rex, or inline regex extract your field.

Below I start matching at end of line (end of field in this case) then create a not capture group for zip or pdf extentions then match everything expect for forward slash.

Example using rex:


…| rex field=<your_field> "(?<filename>[^/]+.(?:zip|pdf)$)"| table filename

Additional Reading:

Hope this help or gets you started.

Cheers,

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...