All Apps and Add-ons

How to create 2 regex to extract the "intranet" and the "output"?

Loves-to-Learn Lots

Hi,  we have some data that contains a hierarchy of folders that we want to extract from the source path, the raw data looks like this : 

source= /usr/local/intranet/areas/ua1/output/MUN

we would like to create 2 regex to extract the "intranet" and the "output"

Can someone please help


Labels (1)
Tags (1)
0 Karma

Revered Legend

A similar problem (extracting fields from source) is solved here:

Depending upon the order of the words and what part is static, the regex will change accordingly.

e.g. if "intranet" is always the 3rd segment and "output" is 6th, following regex could work:

^\/usr\/local\/(?<fieldName1>[^\/]+)\/([^\/]+\/){2}(?<fieldName2>[^\/]+) in source


0 Karma


Hi @Bradd23,

you could use a regex like the following

| rex field=source "^(\/\w+){2}\/(?<field1>\w+)\/(?<field2>\w+)"

that you can test at



0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...