Timechart by source with only basename of source

[wang]

I have a timechart that plots response time by source:
index=myidx duration | timechart avg(duration) by source

Because the name of the source are long, the legend on the right hand side of the plot takes over half the panel, squishing the chart to the left. Is there anyway I can do a "basename" of the source path, using just the file name, omitting the directory path?

I suppose I could assign a specific sourcetype for each file but I'm hoping I can just somehow regex basename of source.

[wang]

Thanks. The regex works great!

[lguinn2]

Try this:

index=myidx duration
| eval source = replace(source,"\\","/")
| eval fileNameParts=split(source, "/")
| eval source = mvindex(fileNameParts,mvcount(fileNameParts)-1)
| timechart avg(duration) by source

This splits the source name into parts, and then assigns the last part to source. I also included the replace statement to flip any Windows-style path separators, so this should work even in a mixed environment.

[Ayn]

Sure, just grab the last portion of the path, write it to another field and then timechart by that instead:

index=myidx duration | rex field=source "/(?<source_file>[^/]+)$" | timechart avg(duration) by source_file