Getting Data In

source name setup with wildcard

SS1
Path Finder

Hi Everyone,

Currently i am monitoring the *.log files under a path, i have not given a source name since we dont have a definite source The file names keep on updating

My Inputs.conf

[monitor://[path]\*.log]
disabled = 0
index = test
sourcetype = sourcetypetest

When the data is indexed into splunk, it is giving the source names as "E:\test\Apps\path\EventLogs\MemoCPU\user-MemoCPU.log'' where as i just want to extract the 'user-MemoCPU' field in the source and display in a dashboard panel. Please let me know if its possible

I am building a dashboard panel with below query,

index = test | stats count by source | sort -count

 

 

Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

Yes, 
For the first one just extract the user part:

index = test | rex field=source "\\\\(?<source>\w+)-\w+.log$" | stats count by source | sort -count

 

For the second one:

index = test | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | table source, issue

 

If this reply helps you, an upvote/like would be appreciated.

 

View solution in original post

SS1
Path Finder

Thanks, this worked like a charm.

output is shown as below

source                       count

user-MemoCPU        1

 

Is there a way i can show output as just like below

source                       count

user       1

or

source                       issue

user                       MemoCPU        

 

 

 

0 Karma

manjunathmeti
Champion

Yes, 
For the first one just extract the user part:

index = test | rex field=source "\\\\(?<source>\w+)-\w+.log$" | stats count by source | sort -count

 

For the second one:

index = test | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | table source, issue

 

If this reply helps you, an upvote/like would be appreciated.

 

View solution in original post

SS1
Path Finder

Thanks a lot, both working fine !

0 Karma

manjunathmeti
Champion

You are welcome! Upvotes will be appreciated!

0 Karma

manjunathmeti
Champion

You can use rex to extract the only filename:

index = test | rex field=source "(?<source>[^\\\\]+)\.log$" | stats count by source | sort -count

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.