topic Re: Override source field in the indexers in Getting Data In

Override source field in the indexers

isha_rastogi — Tue, 15 Sep 2015 12:44:34 GMT

I have configured heavy weight forwarders to get the JMX server data. While forwarding the data to indexers, source field displays the path of those servers. I want to reduce the unwanted strings and override the source field with only server names in it.

source="service:jmx:rmi:///jndi/rmi://abcde000001234:1111/jmxrmi"

I want the source field to extract

source =abcde000001234:1111

I tried to override the field using props and transforms

Transforms.conf
[source]
REGEX =(.*)(:\/\/)(.*)(\/jmxrmi)
FORMAT = source::$3
SOURCE_KEY=MetaData:Source
DEST_KEY = MetaData:Source

Props.conf  
[jmx]
REPORT-source = source
SHOULD_LINEMERGE = false
MAX_TIMESTAMP_LOOKAHEAD = 50

However, I am able to extract different field capturing only desired output using inline search.
But I want the source field to display only the host name from where data is coming and remove all irrelevant strings. Is there any way to get it?

Re: Override source field in the indexers

woodcock — Tue, 15 Sep 2015 15:26:34 GMT

In props.conf, change this:

REPORT-source = source

To this:

TRANSFORMS-source = source

Then deploy to all Heavy Forwarders and restart all Splunk instances on them.

Re: Override source field in the indexers

somesoni2 — Tue, 15 Sep 2015 15:30:50 GMT

Where did you apply the props.conf and transforms.conf?? Heavy forwarders right??

Re: Override source field in the indexers

somesoni2 — Tue, 15 Sep 2015 15:43:30 GMT

You've a great eye in finding these...:)

Re: Override source field in the indexers

woodcock — Tue, 15 Sep 2015 15:53:21 GMT

I have done everything wrong that it is possible to do wrong; education by scars keeps memory sharp!

Re: Override source field in the indexers

isha_rastogi — Tue, 15 Sep 2015 16:13:53 GMT

Already tried replacing Report to transforms and got no success. I want to change the source field in the indexers.

Re: Override source field in the indexers

woodcock — Tue, 15 Sep 2015 16:32:32 GMT

Indexed data is immutable; are you checking new events or old events? Old events cannot be changed. You can delete it, clear the fishbucket and re-forward it, though.

Re: Override source field in the indexers

isha_rastogi — Thu, 17 Sep 2015 17:59:32 GMT

It worked on new indexed data. Thanks!!