How to extract the file extensions from Filename field values into a new field and filter against a static list?

[jclemons7]

Hello

I have a field called "Filename" and I'd like to attain the equivalent of SQL's Where FieldName IN (). The field has values as follows of course:

Test.txt
MyFiles.html
My Compiled Code.exe

I want to basically say "give me every FileName where extension in (txt,exe)". I'd also like to end up with a field called "extension" that does not include the preceding .

How I would do that in SQL is to parse the string after the first dot, then compare it to a list using the IN keyword..

Any help is greatly appreciated..

[MuS · Accepted solution]

Hi jclemons7,

based on your provided example you can try something like this:

your base search here to get the list 
| rex field="Filename" "\.(?<extension>[^\.]*$)" 
| search extension="txt" OR extension="exe" | ...

This will create the extension field using the regex to match everything after the last . which is not a ., search for extension txt or exe and you can use it to process further down the Splunk search.

Hope this helps to get you started ...

cheers, MuS

[mrgibbon]

Thanks MuS!