Splunk Search

How to extract the file extensions from Filename field values into a new field and filter against a static list?

jclemons7
Path Finder

Hello

I have a field called "Filename" and I'd like to attain the equivalent of SQL's Where FieldName IN (). The field has values as follows of course:

Test.txt
MyFiles.html
My Compiled Code.exe

I want to basically say "give me every FileName where extension in (txt,exe)". I'd also like to end up with a field called "extension" that does not include the preceding .

How I would do that in SQL is to parse the string after the first dot, then compare it to a list using the IN keyword..

Any help is greatly appreciated..

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi jclemons7,

based on your provided example you can try something like this:

your base search here to get the list 
| rex field="Filename" "\.(?<extension>[^\.]*$)" 
| search extension="txt" OR extension="exe" | ...

This will create the extension field using the regex to match everything after the last . which is not a ., search for extension txt or exe and you can use it to process further down the Splunk search.

Hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi jclemons7,

based on your provided example you can try something like this:

your base search here to get the list 
| rex field="Filename" "\.(?<extension>[^\.]*$)" 
| search extension="txt" OR extension="exe" | ...

This will create the extension field using the regex to match everything after the last . which is not a ., search for extension txt or exe and you can use it to process further down the Splunk search.

Hope this helps to get you started ...

cheers, MuS

mrgibbon
Contributor

Thanks MuS!

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...