topic Change source file name while indexing in Getting Data In

Change source file name while indexing

splunkwar — Wed, 30 Sep 2020 04:47:22 GMT

Hi,

I have a source file something like this Samplefile_Infobar_20200331 and I would like to view the source as Samplefile_Infobar_2020-03-31 on Splunk search head (With hyphens between the yyyymmdd). How to do it.

Thanks

Re: Change source file name while indexing

gcusello — Mon, 30 Mar 2020 12:04:34 GMT

hi @ splunkwar
try something like this:

| makeresults | eval source="Samplefile_Infobar_20200331.log"
| rex field=source "^(?<prefix>.*)(?<year>\d\d\d\d)(?<month>\d\d)(?<day>\d\d)(?<ext>.*)"
| eval source_final=prefix.year."-".month."-".day.ext
| table source source_final

Ciao.
Giuseppe

Re: Change source file name while indexing

splunkwar — Mon, 30 Mar 2020 12:22:29 GMT

Thanks @gcusello , is there a way to achieve same before indexing ?
thanks in advance.

Re: Change source file name while indexing

gcusello — Mon, 30 Mar 2020 14:09:59 GMT

hi @splunkwar,
I cannot test it, so try something like this:
transforms.conf

[source_override]
REGEX = ^(.*)_(\d\d\d\d)(\d\d)(\d\d)(.*)
FORMAT = source::$1_$2-$3-$4$5
SOURCE_KEY=MetaData:Source
DEST_KEY = MetaData:Source

props.conf

[your_sourcetype]
REPORT-source = source_override

Ciao.
Giuseppe

Re: Change source file name while indexing

splunkwar — Mon, 30 Mar 2020 14:47:35 GMT

Thanks, it works. 🙂

Re: Change source file name while indexing

gcusello — Mon, 30 Mar 2020 15:16:40 GMT

You're welcome!
See next time!
ciao.
Giuseppe