extract string from existed field value and put that string in under new field anme

[kannu]

Hi Splunkers,

I have pre-existed field know as "source" whose values are
1> /var/tomcat/instance15/logs/catalina.out
2> /var/tomcat/instance06/logs/catalina.out
3> /var/tomcat/instance11/logs/catalina.out

What i need to do is to extract instance15, instance06,instance11 from it and put those all values in under new field called as "Instances"

Please help me in getting the rex expression for it .

Note : The instance number is subjected to change it might be 12, 13 any double number .

Thanks in advance

[gcusello · Accepted solution]

Hi
If your path before Instances is fixed, you can use

| rex field=source "\/var\/tomcat\/(?<Instances>[^\/]*)"

You can test it at https://regex101.com/r/A0TQ61/1.
if otherwise path could be variable but with a fixed number of segments, you can use

| rex field=source "\/[^\/]*\/[^\/]*\/(?<Instances>[^\/]*)"

Bye.
Giuseppe

[kannu]

that's working
can you please let me know from where i can learn regex
From where you have learnt

[kannu]

@cusello

that's working
can you please let me know from where i can learn regex
From where you have learnt

[gcusello]

Hi kannu,
I learned trying on regex101.com
Anyway, this site is good
http://www.regular-expressions.info/
and you can find many other on internet.

Anyway trying on regex101 for me it's the best way, searching on internet when you're not able to.

Bye.
Giuseppe
P.S. if you're satisfied, please accept or upvote this answer.