how to get middle string from source field in splu... - Splunk Community

Splunk Search

sourcetype=XXX "Server has been shutdown" | table _time, host, tag::host, _raw,source,field

hear my source is /opt/Messaging/JMS/jms-node1/bin/Nohub.log from this source i need jms-node1

Hi,

You can use rex command

| rex field=source "\/opt\/Messaging\/JMS/(?P<nodename>[^\/]+)\/bin\/Nohub\.log"

Assuming you always want the fourth level of the source path, this should do the job.

sourcetype=XXX "Server has been shutdown" | rex field=source "/opt/Messaging/JMS/jms-node1/bin/Nohub.log" | table _time, host, tag::host, _raw,source,field

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority. Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...