Regex to find a directory in a path

[rileyken]

I have these paths as sources for an index (the paths are linux file system paths)

/usr/local/myfiles1/myfacilityA/Debug/ADT/ADT_2019-07-30.txt
/usr/local/myfiles2/myfacilityB/Debug/ADT/ADT_2019-07-30.txt
/usr/local/myfiles1/myfacilityC/Debug/ADT/ADT_2019-07-30.txt

i would like to be able to extract "myfacility" as a field so I can search for all of the events with that source path.

It would be fantastic to just capture everything between the /usr/local/myfiles? and the /Debug/ADT/ADT....

[bwlm]

If you would like to avoid cumbersome regex rules and are just looking for the fourth directory (or 0-4 directory path) you may want to consider the Splunk Multivalue eval functions "mvindex", "split", and "mvjoin" to do the work for you... note that the "nomv" commands are optional in most cases.

| makeresults
| eval filepathname="/usr/local/myfiles1/myfacilityA/Debug/ADT/ADT_2019-07-30.txt"
| eval Dir4=mvindex(split(filepathname,"/"),4,4) 
| nomv Dir4
| eval Dir0to4=mvjoin(mvindex( split(filepathname,"/"),0,4), "/") 
| nomv Dir0to4

[rileyken]

This was just what I was looking for! Thanks Jamie

[jaime_ramirez · Accepted solution]

For myfacility field:

...
| rex field=source "\/usr\/local\/myfiles\d+\/myfacility(?<myfacility>.*?)\/Debug\/ADT\/"

And for everything between the /usr/local/myfiles? and the /Debug/ADT/ADT:

...
| rex field=source "\/usr\/local\/myfiles(?<myfacilityPath>.*?)\/Debug\/ADT\/"

Hope it helps