writing a rex for transforms

gurinderbhatti — Mon, 28 Sep 2020 15:38:41 GMT

Hello All,
I would appreciate some assistance in writing a transforms stanza.
I am ingesting logs in which both the logname and one of the path directories both have random names. This is causing my source count to go through the roof. See below:

/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920647/AE_BICURCNV_1920647.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920659/AE_BICURCNV_1920659.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920665/AE_BICURCNV_1920665.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920672/AE_BICURCNV_1920672.AET
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920672/AE_BICURCNV_1920672.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920678/AE_BICURCNV_1920678.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920695/AE_BICURCNV_1920695.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920723/AE_BICURCNV_1920723.stdout

As you can see the directory before the log file keeps on changing. I need to write a transform to ignore everything after 'AE' and then the file name.
So it almost would like the following:
/appserv/prcs/FSPRD/log_output/AE/AE.stdout

Can someone help me write the regex for my transforms base file that i can reference which would achieve this. thanks in advance.

Re: writing a rex for transforms

lukejadamec — Mon, 13 Jan 2014 20:33:26 GMT

No. You can't do that with a regex. I mean you can create the REGEX, but it will not effect the source overload. The REGEX just tells Splunk which file to 'get'. The determination of Source is something completely different - it is automatic and it is based on the real file path.

What you really want to do is override source. Check out this doc:

http://answers.splunk.com/answers/97128/question-about-override-source-value-for-a-single-input

topic writing a rex for transforms in Getting Data In

writing a rex for transforms

Re: writing a rex for transforms