Splunk Search

Regex help

SS1
Path Finder

Hi,

I have below sources,

source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log

source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log

 

Instead of displaying full paths i want the source to display just, can we have a rex for this one

source = user1

source = user2

source = user3

source = user4

Labels (5)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@SS1 

Can you please try this?

YOUR_SEARCH 
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

My Sample Search :

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

SS1
Path Finder

Yes, this working now. Thanks @kamlesh_vaghela @gcusello 

0 Karma

SS1
Path Finder

No, this was regex was unable to extract the user field

0 Karma

gcusello
Esteemed Legend

Hi  @SS1,

the solution of @kamlesh_vaghela  is running on my Splunk.

Eventually, you could try something near:

| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"

to test in this way:

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"
| table source user

Ciao.

Giuseppe

kamlesh_vaghela
SplunkTrust
SplunkTrust

@SS1 

Can you please try this?

YOUR_SEARCH 
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

My Sample Search :

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...