Dynamically set index based on source file path

mahesh_ravji1 — Thu, 01 May 2014 12:23:56 GMT

Hi All,

I have log files in directory structure like this:

/var/log/data/index-a/logfile1.log

/var/log/data/index-b/logfile1.log

/var/log/data/index-c/logfile1.log

I want to dynamically set the index to the 4th element of the source path (i.e. index-a, index-b or index-c).

I have configured the following settings:

$SPLUNK_HOME/etc/system/local/inputs.conf

[monitor:///var/log]

disabled = false

followTail = 0

_blacklist = .(gz|zip|bkz|arch|trc)$

$SPLUNK_HOME/etc/system/local/props.conf

[source::.../var/log/data/.*]

TRANSFORMS-index = override-index

$SPLUNK_HOME/etc/system/local/transforms.conf

[override-index]

SOURCE_KEY = MetaData:Source

REGEX = /var/log/data/([^/]+)

FORMAT = $1

DEST_KEY = _MetaData:Index

However all log files are directed default main index.

Re: Dynamically set index based on source file path

kheli — Thu, 01 May 2014 13:35:04 GMT

have you tried to change the regex in the source stanza to something like this [source::.../var/log/data/...]

mahesh_ravji1 — Fri, 02 May 2014 04:04:16 GMT

That seems to have resolved by issue. Thanks every much.