You probably already have your solution in 2021, but anyway, here's a solution: | makeresults | eval path="/opt/splunk/etc/system/local/inputs.conf" | eval base_path=replace(path,"\/[^\/]+\.[^\/]+$","") | table path base_path
... View more
A very late reply. But this works very well to get the base path: | makeresults | eval path="/opt/splunk/etc/system/local/inputs.conf" | eval base_path=replace(path,"\/[^\/]+\.[^\/]+$","") | table path base_path
... View more