Splunk Search

Timechart by source with only basename of source

wang
Path Finder

I have a timechart that plots response time by source:
index=myidx duration | timechart avg(duration) by source

Because the name of the source are long, the legend on the right hand side of the plot takes over half the panel, squishing the chart to the left. Is there anyway I can do a "basename" of the source path, using just the file name, omitting the directory path?

I suppose I could assign a specific sourcetype for each file but I'm hoping I can just somehow regex basename of source.

Tags (2)
0 Karma

wang
Path Finder

Thanks. The regex works great!

0 Karma

lguinn2
Legend

Try this:

index=myidx duration
| eval source = replace(source,"\\","/")
| eval fileNameParts=split(source, "/")
| eval source = mvindex(fileNameParts,mvcount(fileNameParts)-1)
| timechart avg(duration) by source

This splits the source name into parts, and then assigns the last part to source. I also included the replace statement to flip any Windows-style path separators, so this should work even in a mixed environment.

0 Karma

Ayn
Legend

Sure, just grab the last portion of the path, write it to another field and then timechart by that instead:

index=myidx duration | rex field=source "/(?<source_file>[^/]+)$" | timechart avg(duration) by source_file
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...