Splunk Search

regex to get only the filename and filedate

Communicator

Hi,

My requirement is to show the date when the index got last created or to show the date of the latest file whose data is shown in the dashboard. How can i do that.

My index=bla source="D:\path1\dir1\data_19042018.csv"

i want to extract only the filename into a field filename using rex and also just the date it got indexed that is 19042018 into a field named indexed_date.

How to achieve this

Tags (3)
0 Karma
1 Solution

Legend

Hi surekhasplunk,
try regexes like these:

My_index=bla source="D:\\path1\\dir1\\data_19042018.csv"
| rex field=source "\\(?<filename>\w*\.csv)"
| rex field=source "(?<filename>\d*)\.csv"

as you can test at https://regex101.com/r/ifSjOE/1

Bye.
Giuseppe

View solution in original post

0 Karma

Champion

Can you try:

| rex field=source "\\(?<filename>\w*\.csv)" 
|rex field=source "\\\w*_(?<indexed_date>[^\.]+)\.csv"
0 Karma

Legend

Hi surekhasplunk,
try regexes like these:

My_index=bla source="D:\\path1\\dir1\\data_19042018.csv"
| rex field=source "\\(?<filename>\w*\.csv)"
| rex field=source "(?<filename>\d*)\.csv"

as you can test at https://regex101.com/r/ifSjOE/1

Bye.
Giuseppe

View solution in original post

0 Karma