How to assign field to value?

vkhour — Mon, 17 Aug 2020 20:03:44 GMT

Hi all,

I am a new to Splunk and looking for some guidance.

I have created a new sourcetype in my inputs.conf file on my Linux forwarder workstation. It is monitoring /home/*/.bash_history file to check for user's commands. I can see data coming through on the Splunk UI, but I don't know how to assign a field to the value.

Example: it list the date time of the event and the command. I was use to seeing something like this: "exe=su -" or "exe="cat inputs.conf". Instead I get the following:

8/17/20 1:52:35.000 PM su -

8/17/20 1:52:32.000 PM cat inputs.conf

I am trying to create a table for this. How would I create a field "action" and assign the commands such as "su -" and "cat inputs.conf" to that field?

topic Re: How to assign field to value? in Getting Data In

How to assign field to value?

Re: How to assign field to value?