add dynamic field in splunk

chandansingh — Thu, 03 Mar 2011 19:05:44 GMT

Hi everyone , i would like to add a field in splunk.but field value does not come in result.

here my source are:- 1. C:\Program Files\Splunk\etc\apps\tougou\tougou_logs\guest1\host_name\afkcd01_KLZ_Disk_110208.csv 2. C:\Program Files\Splunk\etc\apps\tougou\tougou_logs\guest2\host_name\afkcd01_KLZ_Disk_110208.csv C:\Program Files\Splunk\etc\apps\tougou\tougou_logs\guest3\host_name\afkcd01_KLZ_Disk_110208.csv

i want add field with name guest, as above sources there are diffirent diffirent guest like guest1, guest2 and guest. so i would like serch result based on guest field like:- index = "tougou" guest="guest1" index = "tougou" guest="guest2" as we know source always come in result. but i dont know how to add field guest in splunk. please help me to resolve this problem. thanx in advnce.

Re: add dynamic field in splunk

dwaddle — Thu, 03 Mar 2011 22:26:22 GMT

If I understand your question correctly, you want to extract a field from the "source" metadata associated with the event. (That is, not from the "_raw" event text.) As far as I know, the only way to do that is to create an indexed field. There are a number of caveats that go along with creating indexed fields - I would recommend discussing your exact scenario and its performance and other implications with Splunk support. That said, we use this as a basic formula for pulling indexed fields from "source":

(props.conf)
[tougou]
TRANSFORMS-guest=togou_guest

(transforms.conf)
[togou_guest]
SOURCE_KEY=MetaData:Source
REGEX=ntt_tougou\\tougou_logs\\([^\\]+)\\
FORMAT=guest::$1
WRITE_META=true

(I am a little unsure on the backslashes and how many are needed in the regex example. My day job is not Windows)

topic Re: add dynamic field in splunk in Splunk Search

add dynamic field in splunk

Re: add dynamic field in splunk