Splunk Search

Regex help

SS1
Path Finder

Hi,

I have below sources,

source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log

source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log

source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log

 

Instead of displaying full paths i want the source to display just, can we have a rex for this one

source = user1

source = user2

source = user3

source = user4

Labels (5)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@SS1 

Can you please try this?

YOUR_SEARCH 
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

My Sample Search :

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

SS1
Path Finder

Yes, this working now. Thanks @kamlesh_vaghela @gcusello 

0 Karma

SS1
Path Finder

No, this was regex was unable to extract the user field

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi  @SS1,

the solution of @kamlesh_vaghela  is running on my Splunk.

Eventually, you could try something near:

| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"

to test in this way:

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>[^\\\]+)\\\\"
| table source user

Ciao.

Giuseppe

kamlesh_vaghela
SplunkTrust
SplunkTrust

@SS1 

Can you please try this?

YOUR_SEARCH 
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

My Sample Search :

| makeresults | eval _raw="_raw
source =  C:\Stats\user1\Tmpdata\Mappers\Consolesx\start.log
source =  C:\Stats\user2\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user3\Tmpdata\Mappers\Consolesx\start.log
source = C:\Stats\user4\Tmpdata\Mappers\Consolesx\start.log" | multikv forceheader=1| extract
| rex field=source "C:\\\\Stats\\\\(?<user>\w+)\\\\"
| table source user

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...