All Apps and Add-ons

How to create 2 regex to extract the "intranet" and the "output"?

Bradd23
Loves-to-Learn Lots

Hi,  we have some data that contains a hierarchy of folders that we want to extract from the source path, the raw data looks like this : 

source= /usr/local/intranet/areas/ua1/output/MUN

we would like to create 2 regex to extract the "intranet" and the "output"

Can someone please help

Thanks

Labels (1)
Tags (1)
0 Karma

somesoni2
Revered Legend

A similar problem (extracting fields from source) is solved here:

https://community.splunk.com/t5/Splunk-Search/extract-a-field-from-event-source-filename/m-p/36029

Depending upon the order of the words and what part is static, the regex will change accordingly.

e.g. if "intranet" is always the 3rd segment and "output" is 6th, following regex could work:

^\/usr\/local\/(?<fieldName1>[^\/]+)\/([^\/]+\/){2}(?<fieldName2>[^\/]+) in source

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Bradd23,

you could use a regex like the following

| rex field=source "^(\/\w+){2}\/(?<field1>\w+)\/(?<field2>\w+)"

that you can test at https://regex101.com/r/zXtNKV/1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...