Splunk Search
Highlighted

How to extract the file extensions from Filename field values into a new field and filter against a static list?

Path Finder

Hello

I have a field called "Filename" and I'd like to attain the equivalent of SQL's Where FieldName IN (). The field has values as follows of course:

Test.txt
MyFiles.html
My Compiled Code.exe

I want to basically say "give me every FileName where extension in (txt,exe)". I'd also like to end up with a field called "extension" that does not include the preceding .

How I would do that in SQL is to parse the string after the first dot, then compare it to a list using the IN keyword..

Any help is greatly appreciated..

Highlighted

Re: How to extract the file extensions from Filename field values into a new field and filter against a static list?

SplunkTrust
SplunkTrust

Hi jclemons7,

based on your provided example you can try something like this:

your base search here to get the list 
| rex field="Filename" "\.(?<extension>[^\.]*$)" 
| search extension="txt" OR extension="exe" | ...

This will create the extension field using the regex to match everything after the last . which is not a ., search for extension txt or exe and you can use it to process further down the Splunk search.

Hope this helps to get you started ...

cheers, MuS

View solution in original post

Highlighted

Re: How to extract the file extensions from Filename field values into a new field and filter against a static list?

Contributor

Thanks MuS!

0 Karma