Splunk Search

Timechart by source with only basename of source

wang
Path Finder

I have a timechart that plots response time by source:
index=myidx duration | timechart avg(duration) by source

Because the name of the source are long, the legend on the right hand side of the plot takes over half the panel, squishing the chart to the left. Is there anyway I can do a "basename" of the source path, using just the file name, omitting the directory path?

I suppose I could assign a specific sourcetype for each file but I'm hoping I can just somehow regex basename of source.

Tags (2)
0 Karma

wang
Path Finder

Thanks. The regex works great!

0 Karma

lguinn2
Legend

Try this:

index=myidx duration
| eval source = replace(source,"\\","/")
| eval fileNameParts=split(source, "/")
| eval source = mvindex(fileNameParts,mvcount(fileNameParts)-1)
| timechart avg(duration) by source

This splits the source name into parts, and then assigns the last part to source. I also included the replace statement to flip any Windows-style path separators, so this should work even in a mixed environment.

0 Karma

Ayn
Legend

Sure, just grab the last portion of the path, write it to another field and then timechart by that instead:

index=myidx duration | rex field=source "/(?<source_file>[^/]+)$" | timechart avg(duration) by source_file
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...