Splunk Search

find which event belong to which file in compress file

indeed_2000
Motivator

Hi

I have compress file that contain several files. in source just show compress file. e.g compress files name is log.bz2,  it contain log1 log2 log3

 

currently in source just show log.bz2 , how can I find which event belong to which file?

something like this  log.bz2 > log2

Any idea?

thanks

Labels (3)
0 Karma

tscroggins
Influencer

@indeed_2000 

How did you define your monitor input? What kind of archive is log.bz2? Source would typically have a value like /path/to/log.bz2:./log1, /path/to/log.bz2:./log2, /path/to/log.bz2:./log3, etc.

To replace source with the archived source path:

| rex field=source ":(?!\\\\)(?<source>.*)"

To replace source with the archived source file:

| rex field=source ".*[\\\\/](?<source>.*)"

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...