Splunk Search

Regex help

SS1
Explorer

Hi,

I have below sources,

source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log

source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log

 

Instead of displaying full paths i want the source to display just, can we have a rex for this one

source = user1

source = user2

source = user3

source = user4

Labels (5)
0 Karma

SS1
Explorer

No, this was regex was unable to extract the user field

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi  @SS1,

the solution of @kamlesh_vaghela  is running on my Splunk.

Eventually, you could try something near:

| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"

to test in this way:

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"
| table source user

Ciao.

Giuseppe

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@SS1 

Can you please try this?

YOUR_SEARCH 
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

My Sample Search :

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.