https://community.splunk.com/t5/Getting-Data-In/Problems-with-setting-sourcetype-through-transformations-conf/m-p/47936#M9065 <P>Are you trying to extract the sourcetype out of the source field value?</P> <P>i.e. ---&gt; /Users/admin/Documents/splunkDataToIndex/automation_logs/</P> <P>If so, your regex isnt matching anything.</P> Tue, 09 Aug 2011 18:35:14 GMT carmackd 2011-08-09T18:35:14Z https://community.splunk.com/t5/Getting-Data-In/Problems-with-setting-sourcetype-through-transformations-conf/m-p/47935#M9064 <P>This is driving me mad - have gone through the documentation and responses to queries in here but still can't get sourcetype overrided by using a transform. I'm missing something, I'm guessing obvious, but not obvious to me!</P> <P>inputs.conf</P> <PRE><CODE>[monitor:///Users/admin/Documents/splunkDataToIndex/automation_logs/] disabled = 0 followTail = 0 index = automationlogs </CODE></PRE> <P>props.conf</P> <PRE><CODE>[source::/Users/admin/Documents/splunkDataToIndex/automation_logs/...] TRANSFORMS-set_sourcetype_for_scriptlogs = set_sourcetype_for_scriptlogs priority = 10 </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[set_sourcetype_for_scriptlogs] SOURCE_KEY = MetaData:Source DEST_KEY = MetaData:Sourcetype REGEX = .*/(.*?)\..* FORMAT = Sourcetype::$1 </CODE></PRE> Mon, 25 Jul 2011 14:02:07 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-with-setting-sourcetype-through-transformations-conf/m-p/47935#M9064 quixand 2011-07-25T14:02:07Z https://community.splunk.com/t5/Getting-Data-In/Problems-with-setting-sourcetype-through-transformations-conf/m-p/47936#M9065 <P>Are you trying to extract the sourcetype out of the source field value?</P> <P>i.e. ---&gt; /Users/admin/Documents/splunkDataToIndex/automation_logs/</P> <P>If so, your regex isnt matching anything.</P> Tue, 09 Aug 2011 18:35:14 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-with-setting-sourcetype-through-transformations-conf/m-p/47936#M9065 carmackd 2011-08-09T18:35:14Z