topic Re: add multiple _meta from one field in Getting Data In

How to add multiple _meta from one field?

janroc — Mon, 13 Feb 2023 17:11:38 GMT

Hi all,

I want to have on a HF (8.1.4) multiple _meta of one field values in one stanza.
Any sugestion how?

Example:
accountName = a _meta -> _meta = c-team1
accountName = b _meta -> _meta = c-team2
accountName = c _meta -> _meta = c-team3

Regards Jan

Re: add multiple _meta from one field

gcusello — Mon, 13 Feb 2023 08:48:48 GMT

Hi @janroc,

as described at https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/Configureindex-timefieldextraction, you have to find a regex to identify events to assign values, e.g. if in your events there are the following strings:

accountName = a or accountName = b accountName = c, you have to create something like this:

in props.conf:

[your_sourcetype] TRANSFORMS-meta_a = override_meta_a TRANSFORMS-meta_b = override_meta_b TRANSFORMS-meta_c = override_meta_c

in transforms.conf:

[override_meta_a] REGEX = accountname\s*\=\s*a WRITE_META = true DEST_KEY = _meta DEFAULT_VALUE = c_team1 SOURCE_KEY = _meta

in addition, you have to add, on your indexers, in fields.conf

INDEXED=true

Ciao.

Giuseppe

Re: add multiple _meta from one field

janroc — Mon, 13 Feb 2023 09:10:36 GMT

Hi @gcusello ,

Thank you for the answer and sorry for not give you all information.

We have multiple sourcetypes, will your suggestion work OR should I just one stanza per sourcetype in props.conf?

Will the _meta field overwrite the accountname field?
I want to keep the data in the accountname field as it is and add extra _meta from the accountname.

Regards Jan

Re: add multiple _meta from one field

gcusello — Mon, 13 Feb 2023 09:18:17 GMT

Hi @janroc,

you should create a stanza for each sourcetype in props.conf, but all stanzas can address the same stanzas in transforms.conf.

One hint: why don't you create an automatic field on your Search Heads?

It's much easier to create and manage and does't give a great load in searches.

Ciao.

Giuseppe

Re: add multiple _meta from one field

gcusello — Mon, 13 Feb 2023 10:11:22 GMT

@janroc,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉