Splunk Search

How to write the regex to extract added, removed, and changed files/directories and list them?

gantonio
New Member

How can i extract the added, removed, and changed file/directory and list them to a field respectively using regular expressions?
Below is the sample Splunk event.

Start timestamp: 2016-06-02 05:00:01
Summary:
Total number of files: 76478
Added files: 4
Removed files: 3
Changed files: 3

Added files:
added: /test/dir1/dir2
added: /sample/dir/test
added: /testing/splunk/test
added: /application/test/splunk

Removed files:
removed: /removed/files
removed: /test/removing/files
removed: /sample.txt

Changed files:
changed: /changed/files/sample.txt
changed: /test/app.conf
changed: /app/local.meta

0 Karma
1 Solution

javiergn
Super Champion

Is this what you are looking for?
You can obviously ignore the first 3 lines that I used to reproduce your use case:

| stats count
| fields - count
| eval _raw = "
Start timestamp: 2016-06-02 05:00:01
Summary:
Total number of files: 76478
Added files: 4
Removed files: 3
Changed files: 3

Added files:
added: /test/dir1/dir2
added: /sample/dir/test
added: /testing/splunk/test
added: /application/test/splunk

Removed files:
removed: /removed/files
removed: /test/removing/files
removed: /sample.txt

Changed files:
changed: /changed/files/sample.txt
changed: /test/app.conf
changed: /app/local.meta
"
| rex field=_raw max_match=0 "added: (?<added>[^\n]+)"
| rex field=_raw max_match=0 "removed: (?<removed>[^\n]+)"
| rex field=_raw max_match=0 "changed: (?<changed>[^\n]+)"

Output (see picture):
alt text

View solution in original post

0 Karma

javiergn
Super Champion

Is this what you are looking for?
You can obviously ignore the first 3 lines that I used to reproduce your use case:

| stats count
| fields - count
| eval _raw = "
Start timestamp: 2016-06-02 05:00:01
Summary:
Total number of files: 76478
Added files: 4
Removed files: 3
Changed files: 3

Added files:
added: /test/dir1/dir2
added: /sample/dir/test
added: /testing/splunk/test
added: /application/test/splunk

Removed files:
removed: /removed/files
removed: /test/removing/files
removed: /sample.txt

Changed files:
changed: /changed/files/sample.txt
changed: /test/app.conf
changed: /app/local.meta
"
| rex field=_raw max_match=0 "added: (?<added>[^\n]+)"
| rex field=_raw max_match=0 "removed: (?<removed>[^\n]+)"
| rex field=_raw max_match=0 "changed: (?<changed>[^\n]+)"

Output (see picture):
alt text

0 Karma
Get Updates on the Splunk Community!

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...