topic i need to index the source field value into new fields during index time in Getting Data In

i need to index the source field value into new fields during index time

DataOrg — Wed, 22 Apr 2020 06:04:03 GMT

please help me in indexing source field value into new fields value during index time.
please help with transform/props.conf
i need to extract the source field only the script name with the new field.

source field value will be /splunk_home/etc/apps/bin/python.py

Re: i need to index the source field value into new fields during index time

harsmarvania57 — Wed, 22 Apr 2020 08:31:44 GMT

Hi,

Please try below config on Indexer/Heavy Forwarder whichever comes first from UF.

props.conf

[yoursourcetype]
TRANSFORMS-sourceextract = get_script_from_source

transforms.conf

[get_script_from_source]
SOURCE_KEY = MetaData:Source
REGEX = ([^\/]+$)
FORMAT = script_name::$1
WRITE_META=true

On Search Head

fields.conf

[script_name]
INDEXED = true

Re: i need to index the source field value into new fields during index time

DataOrg — Wed, 30 Sep 2020 05:04:04 GMT

@harsmarvania57 not working.
error captured at splunkd.log

04-22-2020 10:18:56.823 +0000 ERROR regexExtractionProcessor - REGEX field must be specified tranform_name=route_script_pg_thingworx

Re: i need to index the source field value into new fields during index time

harsmarvania57 — Wed, 22 Apr 2020 10:53:31 GMT

There was typo in transforms.conf configuration, it should be SOURCE_KEY = MetaData:Source , not Metadata:Source. I have updated my answer with correct configuration.

Re: i need to index the source field value into new fields during index time

DataOrg — Wed, 22 Apr 2020 11:30:24 GMT

@harsmarvania57 thanks its worked but it not picking a metadata value.
i want to create a new field with static value(hardcoded value). how to create it ?
script_name = abc.py

Re: i need to index the source field value into new fields during index time

harsmarvania57 — Wed, 22 Apr 2020 11:33:27 GMT

What do you mean by "metadata value" ? You mentioned in your question that you want to create new indexed time field based on source and now you are saying that you want to hardcode the value at index time, I am confused now. Please clarify what you want to achieve.

Re: i need to index the source field value into new fields during index time

DataOrg — Wed, 22 Apr 2020 11:51:20 GMT

i want to create a field with hard-corded script name value during index time itself since i cant use source field it was pointing something,

Re: i need to index the source field value into new fields during index time

harsmarvania57 — Wed, 22 Apr 2020 13:10:22 GMT

Remove above props & transforms config and try below configuration on UF

inputs.conf

[script://path/your_script.py]
_meta = script_name::abc.py

Re: i need to index the source field value into new fields during index time

DataOrg — Thu, 23 Apr 2020 06:07:56 GMT

@harsmarvania57 thanks , it worked

Re: i need to index the source field value into new fields during index time

harsmarvania57 — Thu, 23 Apr 2020 10:13:32 GMT

Welcome ..