topic How to set a string in my current source field value as the source in Splunk? in Getting Data In

How to set a string in my current source field value as the source in Splunk?

harishnpandey — Mon, 05 Mar 2018 18:59:45 GMT

Hi ,

Is there any way I can simply have Plprdfinodm01 as my Source in Splunk which indicates JVM name?

D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log
D:\splunk\waslp\vxpip-ppm02\PIprdfinodm01\messages.log

Re: How to set a string in my current source field value as the source in Splunk?

livehybrid — Mon, 05 Mar 2018 22:01:48 GMT

I think personally I would create a new field (field extraction) called something like JVMHost. That way you preserve the original data.
You could use a regex like this:
.*\\(?<JVMHost>[^\\]+)\\messages.log

Re: How to set a string in my current source field value as the source in Splunk?

livehybrid — Mon, 05 Mar 2018 22:05:34 GMT

Or..you could overwrite the source...

If your sourcetype was called "jvm-log", you'd have a props.conf entry for the sourcetype, identifying the transform rule.

 [jvm-log]
 TRANSFORMS-1_source = force_jvm_source

This references a rule that would be defined in transforms.conf:

 [force_jvm_source]
 SOURCE_KEY =_raw
 REGEX =.*\\([^\\]+)\\messages.log
 DEST_KEY = MetaData:Source
 FORMAT = source::$1