Splunk Search

Timechart by source with only basename of source

wang
Path Finder

I have a timechart that plots response time by source:
index=myidx duration | timechart avg(duration) by source

Because the name of the source are long, the legend on the right hand side of the plot takes over half the panel, squishing the chart to the left. Is there anyway I can do a "basename" of the source path, using just the file name, omitting the directory path?

I suppose I could assign a specific sourcetype for each file but I'm hoping I can just somehow regex basename of source.

Tags (2)
0 Karma

wang
Path Finder

Thanks. The regex works great!

0 Karma

lguinn2
Legend

Try this:

index=myidx duration
| eval source = replace(source,"\\","/")
| eval fileNameParts=split(source, "/")
| eval source = mvindex(fileNameParts,mvcount(fileNameParts)-1)
| timechart avg(duration) by source

This splits the source name into parts, and then assigns the last part to source. I also included the replace statement to flip any Windows-style path separators, so this should work even in a mixed environment.

0 Karma

Ayn
Legend

Sure, just grab the last portion of the path, write it to another field and then timechart by that instead:

index=myidx duration | rex field=source "/(?<source_file>[^/]+)$" | timechart avg(duration) by source_file
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...