Hi, in a search i'm trying to take my 'source' field, do a substring on it and save it as another field. Here's what I have so far for my search
index="XXY" | eval sourcetable = source
an example of the source field is
"D:\Splunk\bin\scripts\Pscprod.psclassdefn.bat"
I need parse out Pscprod.psclassdefn from the 'source' and save it as another field called 'sourcetable'
Here's an alternate solution:
index="XXY" | eval tablename=substr(source,23) | eval tablename=rtrim(tablename,".bat")
Using regular expressions may be a little more flexible if your path keeps changing in length/level:
index="XXY" | rex field=source "(?<sourcetable>[\w.]*).bat"
Here's an alternate solution:
index="XXY" | eval tablename=substr(source,23) | eval tablename=rtrim(tablename,".bat")
What does the 23 stand for in (source,23)?
I'm assuming that the the source field is the name of a script that you're running and you're just indexing the results from said script. If that assumption is correct, could you just output the portion that you're looking for as part of the result of the script?