Splunk Search

How to Extract value from Source Field

saroj005
Engager

Hi,

I want to Extarct Filed from Source file and Below are some
Sorce file.

/opt/si/logs/taopwssid1/admin/paas-cli.log.07-11-17
/opt/si/logs/umsawssis1/admin/tcmgr.log
/opt/si/logs/saidwssid2/admin/paas-cli.log.07-11-16

I want to extract below value
taopwssid1
umsawssis1
saidwssid2

How Can i Do this through REX.

Tags (1)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try this.. It will create a new field called host_name with the extracted fields your looking for

| rex field=source \/opt\/\w+\/\w+\/(?<host_name>\w+)

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this

your base search 
| rex field=source "^(\/[^\/]+){3}\/(?<YourFieldName>[^\/]+)"
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this.. It will create a new field called host_name with the extracted fields your looking for

| rex field=source \/opt\/\w+\/\w+\/(?<host_name>\w+)

0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...