Ex:
/nfs/tibcosoftware/splunk/impactAnalysis/freight/ConwayServicesOMSEvents/1.01-49/AESchemas
/nfs/tibcosoftware/splunk/impactAnalysis/freight/Conway-OMSEvents/1.01-SNAPSHOT-57/AESchemas
iaComponent=freight
iaProjectName= ConwayServicesOMSEvents or Conway-OMSEvents
iaReleasedVersionName= 1.01-49 or 1.01-SNAPSHOT-57
I have tried the following, but I cannot get <Project> literals with -
or <Version> literals with no SNAPSHOTS.
index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "(/\w*)+(/\w*)+(/\w*)+(/\w*)+(?<iaComponent>(/\w*))+(?<iaProjectName>(/\w*))+(?<iaReleasedVersionName>(/\d*)\.(\d*)[^-]*(-SNAPSHOT))" | dedup iaComponent, iaProjectName, iaReleasedVersionName | table iaComponent, iaProjectName, iaReleasedVersionName
Please advise?
Try this regex
\/(?:[^\/]*\/){4}(?P<iaComponent>[^\/]+)\/(?P<iaProjectName>[^\/]+)\/(?P<iaReleasedVersionName>[^\/]+)\/
Try this regex
\/(?:[^\/]*\/){4}(?P<iaComponent>[^\/]+)\/(?P<iaProjectName>[^\/]+)\/(?P<iaReleasedVersionName>[^\/]+)\/
Thank you Rich - I did get most of the desired results all versions except for versions with SNAPSHOT. Any idea how to include the SNAPSHOTS?
I am adding a few example paths here:
/nfs/tibcosoftware/Splunk/impactAnalysis/menlo/FSIValidationForClassic/1.02-SNAPSHOT-1.02-SNAPSHOT.24
/nfs/tibcosoftware/Splunk/impactAnalysis/sharedapps/CSCHRCompanyEventPublisher/1.0.0-8
/nfs/tibcosoftware/Splunk/impactAnalysis/freight/ConwayServices-Customer/1.04-SNAPSHOT-47
index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "\/(?:[^\/]*\/){4}(?P[^\/]+)\/(?P[^\/]+)\/(?P[\d\.\-]+)(?:\/|-SNAPSHOT)" | dedup iaComponent, iaProjectName, iaReleasedVersionName | table iaComponent, iaProjectName, iaReleasedVersionName
Sorry, I thought you intended to exclude snapshots. I've updated my answer to include them.
Sure my bad ! I see this seems to return what I want
index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "\/(?:[^\/]*\/){4}(?P[^\/]+)\/(?P[^\/]+)\/(?P[^\/]+)\/" | dedup iaComponent, iaProjectName, iaReleasedVersionName | table iaComponent, iaProjectName, iaReleasedVersionName
Thank you !!
Not sure if your Projectname has both always or you have it here just as an example of possible names. If it is just an example, you can exclude the rex for pname1
ProjectName=\s(?<pname>[\w-]+)\sor\s(?<pname1>[\w-]+)
Not sure I understand you comment about no SNAPSHOTS. But here's something for you to work with
VersionName=\s(?<pname>[\d\.-]+)\sor\s(?<pname1>[\d\.]+)
Thank you sundar. But I could not get any results.. maybe the search command is wrong... Here is what I tried
index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "\s(?[\d.-]+)\sor\s(?[\d.]+)" | dedup pname, pname1 | table pname, pname1
Now I see what you are looking for. Try this
\/(?:[^\/\s]*\/){4}(?<iaComponent>[^\/]+)\/(?<iaProjectName>[^\/]+)\/(?<iaReleasedVersionName>[^\/]+)