Hello Splunkers!
My eventdata places on folders:
/folder1/subfolder1/123/log1.log
/folder1/subfolder1/234/log2.log
/folder1/subfolder1/45/log2.log
My transforms.conf:
[route-index1]
SOURCE_KEY=source
REGEX=???
DEST_KEY=_TCP_ROUTING
I need to extract by REGEX part of source path - 123, 234, 45
Can You help me?
Best regards,
Roman
Try this:
\/[\s\S]+\/[\s\S]+\/([\s\S]+)\/[\s\S]+
Try this:
\/[\s\S]+\/[\s\S]+\/([\s\S]+)\/[\s\S]+
Thank you for quick answer!
And if this part contain literal? For example:
/folder1/subfolder1/foo123/log1.log
/folder1/subfolder1/234boo/log2.log
/folder1/subfolder1/foo45/log2.log
?
If it is the third part of the file path you seek then the same answer applies. If you seek only the numeric part of that path, you can modify the regex to get it. RegExr is a good tool for experimenting with regex strings.
Thank you!