topic How to replace meta information? in Getting Data In

How to replace meta information?

rahiparikh — Wed, 26 Oct 2011 14:52:57 GMT

Hi,

I have a small lab where there is a heavy forwarder. I can/want to perform transformation on Meta info at Heavy forwarder level. I have two related questions.

The first question --

I have a source field something like -- /<dir1>/<dir2>/<logfilename> and I want to remove /<dir1>/<dir2> from source field. How can I do that?

I also want to rewrite sourcetype field before sending data to indexer. Let's say if we find secure in any part of sourcetype then sourcetype should be secure. (i.e. remove all other characters except secure )

Please help!

Thanks!

Re: How to replace meta information?

_d_ — Wed, 26 Oct 2011 15:10:51 GMT

You can try rewriting (reformating) the source key for your first question. You can use transforms and props to do that. Here's an example of how transforms.conf may look like:

transforms.conf

[<unique_transform_stanza_name>] SOURCE_KEY = MetaData:Source REGEX = <regular_expression> FORMAT = source::$1 DEST_KEY = MetaData:Source

props.conf

[<spec>] TRANSFORMS-<value> = <unique_stanza_name>

For your second question you can do pretty much the same thing, but operate on MetaData:Sourcetype instead of Source.

There is additional and very helpful information here:

http://docs.splunk.com/Documentation/Splunk/4.2.4/Admin/Transformsconf

http://docs.splunk.com/Documentation/Splunk/4.2.4/Data/Configureindex-timefieldextraction

- please upvote if you find this answer useful

Re: How to replace meta information?

rahiparikh — Mon, 28 Sep 2020 10:01:30 GMT

Thanks for reply! This works. I have already tried this. But problem with it is -- is a device name. I use host_segment to extract device name. Now, when I use both together, the host_segment will not have effect! 😞

Re: How to replace meta information?

_d_ — Wed, 26 Oct 2011 15:28:33 GMT

In that case then i would try using priority=n in the affected props stanzas. More on priority or precedence can be found here: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Re: How to replace meta information?

rahiparikh — Wed, 26 Oct 2011 15:38:57 GMT

Will this work? I want to perform transformation on Heavy Forwarder and send data to indexer. I do not index locally.