Getting Data In

Capturing logs using regex

nikhilagrawal
Path Finder

Hi,I've below log lines in below
format:

1) D:\SystemX\XManager\TEST1_XM_5_1_0_361\Director\GenericService.log

2) D:\SystemX\XTrader\TEST1_XM_5_1_0_361\Director\GenericService.log

3) D:\SystemX\XInterface\TEST1_XM_5_1_0_361\Director\GenericService.log

How can I get the logs under D:\SystemX\...... I have created field extract filter to seperate XManager, XTrader and Xinterface and I want to view logs in a way that if I select XManager I will see all logs under D:\SystemX\XManager\.. and so on.
The regex i was trying : ^\w+\:\\SystemX\\(?<app>[A-Za-z]*)
But it showing error.

I really appreciate your help.
Thanks

Tags (1)
0 Karma

Lamar
Splunk Employee
Splunk Employee

Nik,

I'm curious why you're not just sourcetyping these...ie:

In props.conf.

[source::.../XManager/.../GenericService.log]
sourcetype = XManager

[source::.../XTrader/.../GenericService.log]
sourcetype = XTrader

[source::.../XInterface/.../GenericService.log]
sourcetype = XInterface

That way, when you search on them you just type:

sourcetype = XManager <rest of your search>

You will get all of the files (regardless of which version they are) that have XManager in the directory structure and end with the filename of GenericService.log.

Hope that helps.

0 Karma

Lowell
Super Champion

Try switching from slashes to backslashes. Remember the backslashes need to be escaped, i.e. \\. (Or, setup a rule that allow for both unix and windows separators using something like this: [source::...[/\\]XInterface[/\\]...[/\\]GenericService.log]. It looks funny, but it should work.

0 Karma

nikhilagrawal
Path Finder

Thanks for suggestion. I should have think this before. I tried the above changes in prop.conf but its not working.
1) I am looking log files from windows machine so I changed the forward slash to backward.

[source::...\XManager\...\GenericService.log]
sourcetype=XManager

Exact location:
D:\SystemX\XManager\TEST1_XM_5_1_0_366\Director\GenericService\Logs\SystemX\GenericService.log

I just have to make the changes under deployment server not on the indexer right?

Please let me correct if I am wrong.
thanks, Nik

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...