Hello
i have source path that looks like :
s3://splunk/OTHER/1/OTHER/Star J750/pjserialnumber/2019-05-06T13:40:37.490Z_1.91.0.192_1.88.0.0_31.29.60.11592/metadata.json
i want to extract "pjserialnumber"
but since i have space in "Star j750"
my regex is not working
rex field=source \/splunk\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+)
my problem is that i want to create a macro from this regex but not all the path's contain space
how can i fix both of the problems ?
thanks
Hi
Give a try
| makeresults
| eval msg="s3://splunk/OTHER/1/OTHER/Star J750/pjserialnumber/2019-05-06T13:40:37.490Z_1.91.0.192_1.88.0.0_31.29.60.11592/metadata.json"
| eval SerialNumber = mvindex(split(msg,"/") ,7)
Hello Sarit,
Kindly find the modified rex query for your reference.
rex field = source \/splunk\/\w+\/\w+\/\w+\/\w+\s+\w+\/(?\w+)
You can change it to something like \/splunk\/\w+\/\w+\/\w+\/(?<SerialNumber>[^\/]*)\/
this is taking the wrong part of the path
Hi
Give a try
| makeresults
| eval msg="s3://splunk/OTHER/1/OTHER/Star J750/pjserialnumber/2019-05-06T13:40:37.490Z_1.91.0.192_1.88.0.0_31.29.60.11592/metadata.json"
| eval SerialNumber = mvindex(split(msg,"/") ,7)
work perfect !