How to extract contents after the last slash in fields in splunk?

Question

I am new to splunk..SO i have a log which has contents(events) in this format

tool_code: error_code (path1/path2/path3/filename1,line) path1.path2.path3.testname1

I wrote rex to extract filenames and testnames rex is

|rex field=_raw (?<UNW>\S+)\s+(?<UNWA>\S+)\s+(?<FILE_NAME>\S+)\s+(?<TEST_NAME>\S+)

this created table of this format (by using this command|table FILE_NAME, TEST_NAME)

FILE_NAME -------------------------------------- TEST_NAME

path1/path2/path3/filename1,line ------------ path1.path2.path3.testname1

but i want FILE_NAME to hold only the name(filename1) and not the path(we should extract the contents before the last slash and after the comma) and similarly TEST_NAME should only have testname1 and not the path.

kindly help me in achieving this

score 1 · Accepted Answer · answered Jun 09 '20 at 12:25

1

You created a field that is called "FILE_NAME". What you can do now, is make a new field using the split command:

   `eval OnlyFileName = mvindex(split(FILE_NAME,"/"),-1)`

eval = make new field

mvindex(split = the split command

"/" = split by /

-1 = the last object in list.

continue spliting until you get what you want.

I recommend using this way which is much simpler than using regex all the time. takes much less time...

answered Jun 09 '20 at 12:25

Gil Kor

314
1
2
9

This partly works...the thing is I'm getting filename1,line How can I strip of the contents after comma ... – Priya Ramakrishnan Jun 09 '20 at 12:39
Very simple, you split again, only this time you change the "/" into ",", and chane -1 into 0. should look like: ```eval ReallyOnlyFileName = mvindex(split(OnlyFileName,","),0)``` – Gil Kor Jun 09 '20 at 12:44
Thank you so much for the Help!! I have been struggling with this for a long time... – Priya Ramakrishnan Jun 09 '20 at 12:57

score 1 · Answer 2 · answered Jun 09 '20 at 12:29

1

Try this regular expression.

| rex "[\S\/]+\/(?<FILE_NAME>\S+),\w+\)\s+[\S\.]+\.(?<TEST_NAME>\w+)$"

answered Jun 09 '20 at 12:29

RichG

9,063
2
18
29

score 0 · Answer 3 · answered Jun 09 '20 at 12:20

I would do this in a couple distinct steps:

| rex field=_raw ":\s+error_code\W+(?<full_path>[^,]+),(?<line>[^)]+)\W+(?<test_path>.+)"

Followed by:

| rex field=full_path "(?<filename>\w+)$"

Followed by:

| rex field=test_path "(?<testname>[^\.]+)$"

Presuming, of course, there are no dots in the "testname" - this will work :)

How to extract contents after the last slash in fields in splunk?

3 Answers3