topic Re: How to set Source equal to filename in input.conf? in Getting Data In

How to set Source equal to filename in input.conf?

moaf13 — Tue, 04 Oct 2016 20:56:07 GMT

There are a lot of documentation on how to set Host equal to filename or directory name, however i couldn't find anything on how to set source equal to file name?

[monitor://.......\fil.log]
disabled=0
source=???
sourcetype= logFile

props.conf

[logFile]
setting
.
.
.

Re: How to set Source equal to filename in input.conf?

sundareshr — Tue, 04 Oct 2016 20:58:23 GMT

The source of an event is the name of the file, stream, or other input from which the event originates. For data monitored from files and directories, the value of source is the full path, such as /archive/server1/var/log/messages.0 or /var/log/. The value of source for network-based data sources is the protocol and port, such as UDP:514

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Aboutdefaultfields

Re: How to set Source equal to filename in input.conf?

moaf13 — Tue, 29 Sep 2020 11:16:56 GMT

Thank you for answering, but this is what I have

[monitor://E:\Users\Documents\fil.txt]
disabled=0
Sourcetype = WindowsFile
queue = parsingQueue

props.conf

[WindowsFile]
bunch of setting.....

[source::E:\Users\Documents\fil.txt]
TRANSFORMS-replace_source = replacedefaultsource

Tranforms.conf

[replacedefaultsource]
SOURCE_KEY = MetaData:Source
REGEX = E:\Users\(Documents)\fil.txt
DEST_KEY = MetaData:Source
FORMAT= source::$1

That's the setting that i have and it's not working, I don't want to full path, I just want the filename. this is what i have and it's not working?

Re: How to set Source equal to filename in input.conf?

somesoni2 — Wed, 05 Oct 2016 01:36:02 GMT

Try this as the REGEX in your transforms.conf

[replacedefaultsource]
SOURCE_KEY = MetaData:Source
REGEX = E:\\Users\\([^\\]+)\\fil.txt
DEST_KEY = MetaData:Source
FORMAT= source::$1

Re: How to set Source equal to filename in input.conf?

moaf13 — Wed, 05 Oct 2016 08:43:36 GMT

Thank you very much. That's exactly what i was looking for.

I also added another change which was removing [source::E:\Users\Documents\fil.txt] entirly from props.conf and moving TRANSFORMS-replace_source to sourcetype setting for anyone looking at this answer in the future.

[WindowsFile]
bunch of setting.....
TRANSFORMS-replace_source = replacedefaultsource

removed ([source::E:\Users\Documents\fil.txt]
TRANSFORMS-replace_source = replacedefaultsource)

Do you know why I had to do that? does splunk prioritize sourcetype setting than other settings in props.conf?