Splunk Search

transforms.conf extract part of sourcepath

Communicator

Hello Splunkers!

My eventdata places on folders:

/folder1/subfolder1/123/log1.log
/folder1/subfolder1/234/log2.log
/folder1/subfolder1/45/log2.log

My transforms.conf:

 [route-index1]
 SOURCE_KEY=source
 REGEX=???
 DEST_KEY=_TCP_ROUTING

I need to extract by REGEX part of source path - 123, 234, 45

Can You help me?

Best regards,
Roman

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this:

\/[\s\S]+\/[\s\S]+\/([\s\S]+)\/[\s\S]+
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this:

\/[\s\S]+\/[\s\S]+\/([\s\S]+)\/[\s\S]+
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Communicator

Thank you for quick answer!

And if this part contain literal? For example:

 /folder1/subfolder1/foo123/log1.log
 /folder1/subfolder1/234boo/log2.log
 /folder1/subfolder1/foo45/log2.log

?

0 Karma

SplunkTrust
SplunkTrust

If it is the third part of the file path you seek then the same answer applies. If you seek only the numeric part of that path, you can modify the regex to get it. RegExr is a good tool for experimenting with regex strings.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Communicator

Thank you!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!