Splunk Search

How do I split a string which contains a path so I'm only getting the first two directories?

DamageSplunk
Explorer

I have several thousand events with a path such as d:\RNREDINFFTP01-AVREDINFWFS01\ebtest1\foo\bar\filename2.txt. The folder name is not static - I'm using a fschange monitor to pull the events so the root directory RNREDINFFTP01-AVREDINFWFS01 and the tertiary directories are not static.

I want to show the size of the files based on the first or second directory, depending on the users need for detail. For instance.

d:\RNREDINFFTP01-AVREDINFWFS01   100 files 100mb

OR

d:\RNREDINFFTP01-AVREDINFWFS01\ebtest1 50 files 50mb
d:\RNREDINFFTP01-AVREDINFWFS01\ebtest2 40 files 40mb
d:\RNREDINFFTP01-AVREDINFWFS01\ebtest3 10 files 10mb

I doubt I'll ever go past the 2nd directory. I've tried using rex and can't seem to get the groups right. If I was using vbscript or powershell I'd simply call split based on \ and then group by the first or the first+second directories. What am I missing?? ...and... what is the best way to tackle this?

1 Solution

woodcock
Esteemed Legend

Try this:

... rex field=source "(?<PathPrefix>(?:[^\\\]+\\\){2})"

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

... rex field=source "(?<PathPrefix>(?:[^\\\]+\\\){2})"
0 Karma

fdinkler
Observer

I'm trying to adapt this for a UNIX path, and I can't tell why it's not working.

I have is 

rex field=uri "(?<PathPrefix>(?:[^/]+/){2})"

 

0 Karma

woodcock
Esteemed Legend

OK, it turns out you need an additional escape character like this (fixed in original answer, too):

... rex field=source "(?<PathPrefix>(?:[^\\\]+\\\){2})"

DamageSplunk
Explorer

That did it! Thank you.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That regex doesn't compile.

If you meant to use a non-capturing group it should be (?:, not (?;.

DamageSplunk
Explorer

Thanks but I'm getting a different error now, Error in 'rex' command: Encountered the following error while compiling the regex '(?(?:[^]+){2})': Regex: missing terminating ] for character class .

I don't see any issues, there's matching Parens and Braces. Any ideas?

Thanks - Eric

0 Karma

woodcock
Esteemed Legend

Yes, thank you for catching the typo (stupid dumb-phone keyboard). It is fixed now.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>