A couple of approaches : 1) The Splunk MYSQL connector includes a search command, mysqloutput, that you can use to insert or update records in a table in a MySQL database based on fields resulting from your Splunk search. 2) you could use one of the Developer SDKs, write a custom program to execute a Splunk search , process the XML/JSON/CSV result and roll this up into a SQL statement to insert/update tables in your database. 3) you could write your own custom search command , and insert this at the end of you search pipeline to insert/update your DB tables with Splunk search fields ie: index=foo sourcetype=goo | stats count by host | myCustomOutputToDBCommand https://answers.splunk.com/answers/55134/automatically-forward-splunk-data-to-database.html ... View more

/Folder1/Folder2/Folder3/Folder4/Folder5/LoadABCDEF_20160921.log I would like to extract the "LoadABCDEF" from the source. the updated query - | rex field=source "\/(? \w+)_" | table sourceRex /Folder1/Folder2/Folder3/OrderOnline_ABCD/Folder4/ path I would like to fetch "OrderOnline_ABCD" from the source(Folder3 may contains an underscore). | rex field=source "(\/\w+){3}\/(?<rexOutput>\w+)\S+" | table rexOutput for learning, \/ -- for matching(escaping) the first "/" \w+ --- match any word character(letter, number, or _) ("+" means, one or more match) {3} ---- match 3 times (/Folder1/Folder2/Folder3/ will be matched till this) then, we need create our rex extraction. ?<rexOutput> --- assign rex extraction to this variable. \w+ ---- the rex is matching for any word character, once or more. \S+ ---- not white space, once or more ... View more