Splunk Search

Regex help

SS1
Path Finder

Hi,

I have below sources,

source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log

source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log

 

Instead of displaying full paths i want the source to display just, can we have a rex for this one

source = user1

source = user2

source = user3

source = user4

Labels (5)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@SS1 

Can you please try this?

YOUR_SEARCH 
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

My Sample Search :

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

SS1
Path Finder

Yes, this working now. Thanks @kamlesh_vaghela @gcusello 

0 Karma

SS1
Path Finder

No, this was regex was unable to extract the user field

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi  @SS1,

the solution of @kamlesh_vaghela  is running on my Splunk.

Eventually, you could try something near:

| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"

to test in this way:

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"
| table source user

Ciao.

Giuseppe

kamlesh_vaghela
SplunkTrust
SplunkTrust

@SS1 

Can you please try this?

YOUR_SEARCH 
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

My Sample Search :

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.