I am trying do a search for all exceptions and list the associated filename instead of the whole path+filename in my results table.
I tried the following in my search but it didn't work:
Exception sourcetype=qagadc1 | rex ".?(?
my source structure is not unique, they are varies as follow:
/home/d1/d2/d3/fn1.log
/home/d1/d2/d3/d4/d5/fn2.out
/home/d1/d2/d3/d4/d5/d6/fn3.log
...
please help.
In case if your filename contains a .
then
# For Unix style
| rex field=<fieldname> "/(?<newField>[\w\d\.]+$)"
That's just a matter of modifying the expression, see my edited answer.
actually, I am trying to get the filename extension (i.e fn2.out, fn3.log) as part of the "fname" returned.
Tried appending what you suggested still does not give me fn3.log, or fn2.out etc.
actually, I am trying to get the filename extension (i.e fn2.out, fn3.log) as part of the "fname" returned.
Tried appending what you suggested still does not give me fn3.log, or fn2.out etc.
actually, I am trying to get the filename extension (i.e fn2.out, fn3.log) as part of the "fname" returned.
Tried appending what you suggested still does not give me fn3.log, or fn2.out etc.
To extract the last segment of a path from a field you can append this to your search:
| eval field = replace(field, ".*/", "")
Edit: If you want the last bit after the final dot you can modify the expression like this:
| eval field = replace(field, ".*\.", "")