Max Filesystem Usage Report: How to rename search results returned so the path names on the chart aren't so long?

[eboniebutler]

I run a report that displays the top filesystem usage percent for a particular server. I've noticed that when I graph the results (line graph), the filesystem names are super long and they cut off. I was wondering if I could rename the filesystem names that are returned from the search so that on the chart, they are displayed in a simplier, more human-readable name.

Thank you!

[somesoni2]

It all depends on how your data (for source field) looks like what possible criteria you have to convert it to more simpler form. You can choose to display just the file name (as suggested by @joshd) OR just the root file system (no file name) OR replacing some common file system part in the value (e.g. C:\Splunk_Logs\ with blank).

[joshd]

You could simply just use the last portion of the filesystem name as the value since that would be the actual file name.

Here is an example of how to rename the source on the fly:

| eval source=mvindex(split(source,"/"),-1)

So for example if I have my source=/home/josh/directory/another_directory/secret_file.txt ... and I use the above, it would now be source=secret_file.txt

Basically I first used the split() function to create a multivalued field (think of an array in programming) where the values would be those separated by a '/'. Then I use the mvindex function to grab a specific position in the multivalued field, in this case using -1 tells it to go to the last position. And voila ... the source field now only contains the value of the file name and not the full filesystem path.

[dflodstrom]

You could use REX to extract only the portion of each filesystem name that you want to see and have that information put into a new field that you report on.