Can I define permanent interpreting rules for specific directories?

leon12 — Mon, 10 Oct 2022 13:43:24 GMT

Hey Guys, I have the following Event Data (Picture 1) that come into splunk via universal forwarder. I managed it to generate a table out of it (by using different operations like a delimiter by /n and the statements of picture 2). My Question is:

Can I define permanent interpreting rules for specific directories, so that the statements of picture 2 and the delimiter by /n are permanently apllicated for some specific directories?:)

Sincreley Leon

Re: Permanent change of data model

gcusello — Mon, 10 Oct 2022 08:37:41 GMT

Hi @leon12,

at first the term "data Model" in Splunk means a different thing that you mean: a data Model is a table containing data extracted from events and archived in a MongoDB table, probably you are meaning "dataset".

Anyway, the parsing configurations are stored in props.conf and are fixed for that sourcetype.

props.conf must be located on the Indexers or, if present, on Heavy Forwarders.

Also the eval transformations can be inserted in the props.conf so you don't need to repeat them in eavery search.

The association between an input folder and a sourcetype is done by you in the inputs.conf.

ciao.

Giuseppe

topic Can I define permanent interpreting rules for specific directories? in Knowledge Management

Can I define permanent interpreting rules for specific directories?

Re: Permanent change of data model