Splunk Search

create new field from substring of another field

jedatt01
Builder

Hi, in a search i'm trying to take my 'source' field, do a substring on it and save it as another field. Here's what I have so far for my search

index="XXY" | eval sourcetable = source

an example of the source field is
"D:\Splunk\bin\scripts\Pscprod.psclassdefn.bat"
I need parse out Pscprod.psclassdefn from the 'source' and save it as another field called 'sourcetable'

Tags (2)
1 Solution

bme7493
Engager

Here's an alternate solution:

index="XXY" | eval tablename=substr(source,23) | eval tablename=rtrim(tablename,".bat")

View solution in original post

ytamura
Path Finder

Using regular expressions may be a little more flexible if your path keeps changing in length/level:

index="XXY" | rex field=source "(?<sourcetable>[\w.]*).bat"

bme7493
Engager

Here's an alternate solution:

index="XXY" | eval tablename=substr(source,23) | eval tablename=rtrim(tablename,".bat")

c48571
New Member

What does the 23 stand for in (source,23)?

0 Karma

bme7493
Engager

I'm assuming that the the source field is the name of a script that you're running and you're just indexing the results from said script. If that assumption is correct, could you just output the portion that you're looking for as part of the result of the script?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...