You probably already have your solution in 2021, but anyway, here's a solution: | makeresults | eval path="/opt/splunk/etc/system/local/inputs.conf" | eval base_path=replace(path,"\/[^\/]+\.[^\/]+$","") | table path base_path ... View more

A very late reply.  But this works very well to get the base path: | makeresults | eval path="/opt/splunk/etc/system/local/inputs.conf" | eval base_path=replace(path,"\/[^\/]+\.[^\/]+$","") | table path base_path ... View more

Thanks mbenwell. You have my vote. Your solution works well even in 2018 (as we still use Splunk 6.x). ... View more

Thanks mbenwell. You have my vote. Your solution works well even in 2018 (as we still use Splunk 6.x). ... View more