Splunk Search

How to extract filename form Source field

Path Finder

Hi team,

I have got a csv files indexed into splunk with names SOURCE= C:\Netwrokanalysis\germany.csv ,c:\networkanalysis\singapore.csv i want to extract country name form this SOURCE field that is germany,singapore

Thanks ,

Tags (2)
0 Karma

Path Finder

Also assigning different sourcetype per county csv file is other option and you can handle it better for your future search queries.

In your input.conf file;

disabled = false
sourcetype = Germany

disabled = false
sourcetype = Singapore

Create Sourcetypes

Hope it helps



This is probably the best solution.

0 Karma


I didn't test it but it should work if the length of the first part of the SOURCE string is always the same.
You can also apply a rex command after applying the split command, but it will do the same than the command proposed by sc0tt

0 Karma


I'm sure there is a more elegant solution, but would something like | eval country = mvindex(split(substr(source,18),"."),0) work?

Edit: This should work as well

rex field=source "c:networkanalysis(?<country>\S+).csv"
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!