topic Re: Renaming sources for charting purposes in Getting Data In

Renaming sources for charting purposes

ericrobinson — Fri, 27 Aug 2010 08:58:11 GMT

Hello, I have a chart that show event counts split by source name. For our analysis, it is very important that we see the source names. Because of the long path, the important part is .....

e.g.

/opt/applocal/fs/dir/Log.log

shows as

/opt/applocal......log

Is there anything from Splunk Web I can do to improve the chart?

Re: Renaming sources for charting purposes

zscgeek — Fri, 27 Aug 2010 10:13:48 GMT

You could use the rex command to rewrite the source field.

... | rex field=source "/(?<sourcefile>[^/]+?)$" | timechart count by sourcefile

That will transform a source that looks like "/opt/applocal/fs/dir/Log.log" to a field called sourcefile like "Log.log"

Re: Renaming sources for charting purposes

Lowell — Fri, 27 Aug 2010 21:13:01 GMT

The replace search command is really helpful here too. It's a little less flexible than the rex approach, but it can also be much simpler to use. (And there's no reason why you can't do both for different types of source names.)

Here is an example I grabbed from one of my saved searches with source renaming:

... | replace "*var*log*splunk*metrics.log*" with "splunk/metrics.log" "/stage/logs/*" with "/stage/logs/LOGFILE" "*var*log*splunk*splunkd.log*" with "splunk/splunkd.log" "/common/log/prefix/*.log" with "*.log" in source | ...