Hello
I have a field called "Filename" and I'd like to attain the equivalent of SQL's Where FieldName IN ()
. The field has values as follows of course:
Test.txt
MyFiles.html
My Compiled Code.exe
I want to basically say "give me every FileName where extension in (txt,exe)". I'd also like to end up with a field called "extension" that does not include the preceding .
How I would do that in SQL is to parse the string after the first dot, then compare it to a list using the IN keyword..
Any help is greatly appreciated..
Hi jclemons7,
based on your provided example you can try something like this:
your base search here to get the list
| rex field="Filename" "\.(?<extension>[^\.]*$)"
| search extension="txt" OR extension="exe" | ...
This will create the extension
field using the regex to match everything after the last .
which is not a .
, search for extension
txt or exe and you can use it to process further down the Splunk search.
Hope this helps to get you started ...
cheers, MuS
Hi jclemons7,
based on your provided example you can try something like this:
your base search here to get the list
| rex field="Filename" "\.(?<extension>[^\.]*$)"
| search extension="txt" OR extension="exe" | ...
This will create the extension
field using the regex to match everything after the last .
which is not a .
, search for extension
txt or exe and you can use it to process further down the Splunk search.
Hope this helps to get you started ...
cheers, MuS
Thanks MuS!