I need to create a field in splunk that is a portion of the file path, do I need to do that @ index time or can I do it at search time? I know the regex just dont know how to make a portion of source into a field in the event.
you can see the source field to the left of the pane and below each event?
If yes then just try | rex field=source (your regex expression)....it will extract the regex from your source field
you can see the source field to the left of the pane and below each event?
If yes then just try | rex field=source (your regex expression)....it will extract the regex from your source field
you can. if your search regex is working fine you can do it at index time in props.conf.. check this out https://answers.splunk.com/answers/5960/extract-a-field-from-event-source-filename.html
However, one year ago I had done something similar and well, it hit me after 6 months when a different team working on the same source wanted to extract something else AND I had already disturbed that by editing the props.conf .... it is better to do this at search time , due to performance considerations as well as keeping future needs into account. However, the call is yours and the link above already answers this, you will have to use (almost) the same regex that you are using at search time.
