Splunk Search

Extraction of extension from filename and flagging them

Jananee_iNautix
Path Finder

I have to do something like according to the extension of the filename that i extract from logs i want to flag them.
For example if filename is of.txt extension I should flag them as T.How can i do that in splunk?can anyone help me on this.

I should get the following result
filename flag
abc.txt T

Tags (1)
0 Karma

linu1988
Champion

Hello,
If you mean to say the first letter after the extension starts then below will do it,

source=..| rex field=filename "\\.(?<Flag>\S+)"|eval Flag=upper(Flag)|eval Flag=case(Flag="ZIP", "C", Flag="TAR", "T", Flag="CSV" OR Flag="TXT" OR Flag="PDF" , "U")|table filename,Flag

Thanks

0 Karma

linu1988
Champion

As Somesh suggested you need to get a lookup which will get you the FLAG details. Alternative is to use a case/if statement. Have updated the query

0 Karma

Jananee_iNautix
Path Finder

i want to get the result like if the file is with.ZIP extension display as "c",with .tar extension display "t",else for all other things display as "u".Can you give search query for this.
filename flag
asd.ZIP c
fefew.tar t
werw.csv u
ew.txt u
fgwe.pdf u

0 Karma

somesoni2
SplunkTrust
SplunkTrust

And if not just always the first letter of the file extension, then you should create a lookup table file with file extension to flag mapping and then do a lookup.

source=..| rex field=filename "\\.(?.*)" | lookup File_Extension OUTPUT Flag

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...