Hi Splunkers,
I have pre-existed field know as "source" whose values are
1> /var/tomcat/instance15/logs/catalina.out
2> /var/tomcat/instance06/logs/catalina.out
3> /var/tomcat/instance11/logs/catalina.out
What i need to do is to extract instance15, instance06,instance11 from it and put those all values in under new field called as "Instances"
Please help me in getting the rex expression for it .
Note : The instance number is subjected to change it might be 12, 13 any double number .
Thanks in advance
Hi
If your path before Instances is fixed, you can use
| rex field=source "\/var\/tomcat\/(?<Instances>[^\/]*)"
You can test it at https://regex101.com/r/A0TQ61/1.
if otherwise path could be variable but with a fixed number of segments, you can use
| rex field=source "\/[^\/]*\/[^\/]*\/(?<Instances>[^\/]*)"
Bye.
Giuseppe
Hi
If your path before Instances is fixed, you can use
| rex field=source "\/var\/tomcat\/(?<Instances>[^\/]*)"
You can test it at https://regex101.com/r/A0TQ61/1.
if otherwise path could be variable but with a fixed number of segments, you can use
| rex field=source "\/[^\/]*\/[^\/]*\/(?<Instances>[^\/]*)"
Bye.
Giuseppe
that's working
can you please let me know from where i can learn regex
From where you have learnt
@cusello
that's working
can you please let me know from where i can learn regex
From where you have learnt
Hi kannu,
I learned trying on regex101.com
Anyway, this site is good
http://www.regular-expressions.info/
and you can find many other on internet.
Anyway trying on regex101 for me it's the best way, searching on internet when you're not able to.
Bye.
Giuseppe
P.S. if you're satisfied, please accept or upvote this answer.