Splunk Search

What is the regular expression to extract substring from a string?

rakeshcse2
New Member

My log source location is : C:\logs\public\test\appname\test.log

I need a regular expression to just extract "appname" from the source location in my search output and then display that as a new column name.

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

Updated

your current search giving field source which contains full file path
| rex field=source "^([^\\\\]+\\\\)+(?<AppName>[^\\\\]+)\\\\"

Runanywhere sample:

| gentimes start=-1 | eval source="C:\logs\public\test\appname\test.log" | table source | rex field=source "^([^\\\\]+\\\\)+(?<AppName>[^\\\\]+)\\\\"

View solution in original post

mpreddy
Communicator

try this:

|stats c |eval _raw="C:\logs\public\test\appname\test.log"|rex field=_raw "\w+.\w+.\w+.(?<appname>\w+)"
0 Karma

rakeshcse2
New Member

Thank you very much, that worked.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

Updated

your current search giving field source which contains full file path
| rex field=source "^([^\\\\]+\\\\)+(?<AppName>[^\\\\]+)\\\\"

Runanywhere sample:

| gentimes start=-1 | eval source="C:\logs\public\test\appname\test.log" | table source | rex field=source "^([^\\\\]+\\\\)+(?<AppName>[^\\\\]+)\\\\"

rakeshcse2
New Member

Thank you, but the appname is not constant and it is different for different application.
I need to extract any xyz appname from the source location.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

It's capturing whatever string comes as the immediate parent to file name. The 2nd is just an example search to test it.

0 Karma

rakeshcse2
New Member

I am using this and its not working:

source=* "error" host="*" | chart count by source | rex field=source "^([^\]+\)+(?[^\]+)\\"

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try with the updated string (needed one additional backslash, 4 at a time)

0 Karma

rakeshcse2
New Member

Sorry, i deleted my last post , that was not clear.

The thing is we just need to change teh regex to include one more / in the source path, that is :

C:\logs\public\test\appname\abcd\test.log
From the top i need to extract appname only.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You need to fix a position for the app name (earliest we assumed it was the last folder before the file name). So can we say it's always the 5th segment from start? If yes, then try this

....| rex field=source "^([^\\\\]+\\\\){4}(?<AppName>[^\\\\]+)\\\\"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...