topic Re: passing source script file name in another field before indexing in Getting Data In

passing source script file name in another field before indexing

DataOrg — Tue, 21 Apr 2020 08:58:47 GMT

i have a script which will be executed from inputs.conf but i need the script file name in a new field instead of source tag.
since i have a default source name configured. i want to add script file(source script) Name to the data indexed in the new field.

[script:///$SPLUNK_HOME/etc/apps/KIO/bin/Stats.py]
    interval = * * * * *
    source = siebel
    sourcetype = inflowstats
    disabled = False 
    index = index1
    host=server1
    Script=ScriptName

Re: passing source script file name in another field before indexing

to4kawa — Tue, 21 Apr 2020 09:17:35 GMT

how about ingest_eval or DEST_KEY in transforms.conf?

Re: passing source script file name in another field before indexing

DataOrg — Tue, 21 Apr 2020 09:45:23 GMT

@to4kawa is it possible to hardcode the value ? to any new field

Re: passing source script file name in another field before indexing

to4kawa — Tue, 21 Apr 2020 10:17:26 GMT

I don't know hardcode .
the field value is indexed as new value by settings.

Re: passing source script file name in another field before indexing

DataOrg — Tue, 21 Apr 2020 11:03:40 GMT

@to4kawa how to do it new field creation with static value at transform.conf

Re: passing source script file name in another field before indexing

to4kawa — Tue, 21 Apr 2020 11:34:05 GMT

https://answers.splunk.com/answers/817188/add-x-hours-to-epoch-time.html#answer-817198

this answer express to change source field value. it can create another field, also.

Re: passing source script file name in another field before indexing

DataOrg — Tue, 21 Apr 2020 14:54:05 GMT

@to4kawa I tried this and not getting any results.

transforms.conf
 [myeval]
 INGEST_EVAL = ScriptName=python_script

 props.conf
 [testLog]
 TRANSFORMS = myeval

fields.conf
 [eval_city]
 INDEXED = True

Re: passing source script file name in another field before indexing

to4kawa — Tue, 21 Apr 2020 19:41:25 GMT

INGEST_EVAL is eval
use "
and in props.conf, class name is needed.

Re: passing source script file name in another field before indexing

DataOrg — Wed, 30 Sep 2020 05:04:01 GMT

@to4kawa is this correct to extract from source? i want to extract the file name alone. i want regex for this. please help

[extract-source]
SOURCE_KEY = MetaData:Source
FORMAT = job_id::$2
WRITE_META = true

source path will be etc/apps/bin/python.py

Re: passing source script file name in another field before indexing

to4kawa — Wed, 22 Apr 2020 08:38:11 GMT

what's $2?
where's REGEX?

Re: passing source script file name in another field before indexing

DataOrg — Wed, 30 Sep 2020 05:04:56 GMT

worked by adding default value in inputs.conf directly.
[script://path/your_script.py]
_meta = script_name::abc.py

Re: passing source script file name in another field before indexing

harsmarvania57 — Thu, 23 Apr 2020 11:14:03 GMT

Duplicate of https://answers.splunk.com/answers/818655/i-need-to-index-the-source-field-value-into-new-fi.html