Getting Data In

How do i extract data from my event source filename

pradiptam
Explorer

I have multiple logfiles like TEST_SRC_FR.txt, TEST_SRC_IN.txt, TEST_SRC_AU.txt which are my source files. Now i want to extract the last two letters like "FR" from TEST_SRC_FR.txt.

Any idea how to get them during search time.

Regards,

Pradipta

0 Karma

Richfez
SplunkTrust
SplunkTrust

Sure!

... | rex field=source "(?<LastTwoLetters>..)\.txt$"

That assume they're the literal field source and that they ALWAYS end with "txt".

Modifications can be made for other similar scenarios, but you'll have to be very specific in describing them. 🙂

Happy Splunking,
Rich

pradiptam
Explorer

Thanks its also working, checking which one to use in my program

Regards,
Pradipta

0 Karma

493669
Super Champion

try this run anywhere search:

| makeresults |eval _raw="TEST_SRC_FR.txt"|rex ".*_(?<name>\w{2})"

in your case you can use as

index=<indexname>| rex field=source ".*_(?<name>\w{2})"

also you can make this regex in props.conf

pradiptam
Explorer

Great its working fine for me.

regards,
Pradipta

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...