transforms.conf extract part of sourcepath

[ryastrebov]

Hello Splunkers!

My eventdata places on folders:

/folder1/subfolder1/123/log1.log
/folder1/subfolder1/234/log2.log
/folder1/subfolder1/45/log2.log

My transforms.conf:

 [route-index1]
 SOURCE_KEY=source
 REGEX=???
 DEST_KEY=_TCP_ROUTING

I need to extract by REGEX part of source path - 123, 234, 45

Can You help me?

Best regards,
Roman

[richgalloway · Accepted solution]

Try this:

\/[\s\S]+\/[\s\S]+\/([\s\S]+)\/[\s\S]+

[ryastrebov]

Thank you for quick answer!

And if this part contain literal? For example:

 /folder1/subfolder1/foo123/log1.log
 /folder1/subfolder1/234boo/log2.log
 /folder1/subfolder1/foo45/log2.log

?

[richgalloway]

If it is the third part of the file path you seek then the same answer applies. If you seek only the numeric part of that path, you can modify the regex to get it. RegExr is a good tool for experimenting with regex strings.

[ryastrebov]

Thank you!