Splunk Search

find which event belong to which file in compress file

indeed_2000
Builder

Hi

I have compress file that contain several files. in source just show compress file. e.g compress files name is log.bz2,  it contain log1 log2 log3

 

currently in source just show log.bz2 , how can I find which event belong to which file?

something like this  log.bz2 > log2

Any idea?

thanks

Labels (4)
0 Karma

tscroggins
Builder

@indeed_2000 

How did you define your monitor input? What kind of archive is log.bz2? Source would typically have a value like /path/to/log.bz2:./log1, /path/to/log.bz2:./log2, /path/to/log.bz2:./log3, etc.

To replace source with the archived source path:

| rex field=source ":(?!\\\\)(?<source>.*)"

To replace source with the archived source file:

| rex field=source ".*[\\\\/](?<source>.*)"

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!