topic Re: Using multiple parameters for regexp host extraction in Splunk Search

Using multiple parameters for regexp host extraction

patrickprodoehl — Thu, 18 Jun 2020 18:54:16 GMT

Dear community,

I am lost in creating a regexp that will ease up my data input creation.

So I do have a file share being monitored by splunk with the following structure:

/data/reports/ApplicationA/LocationA/very_interesting.log
/data/reports/ApplicationA/LocationB/very_interesting.log
/data/reports/ApplicationB/LocationB/very_interesting.log

To scale at ease, I would like to define a single data input for ApplicationA which extracts the host using 2 parameters of the path. i.e.

ApplicationA_LocationA
ApplicationA_LocationB

Do you have any idea, how I could transform the / between ApplicationA and the location subfolders to a _ and after do the pattern matching to extract the host?

Thanks in advance!

Re: Using multiple parameters for regexp host extraction

manjunathmeti — Thu, 19 Mar 2020 19:50:26 GMT

You need to use transforms.conf. Set <spec> to your sourcetype name or source (source::/data/reports/*/*/*.log).

props.conf

[<spec>]
TRANSFORMS-colorchange

transforms.conf

[set_host]
SOURCE_KEY = MetaData:Source
REGEX = (\w+)\/(\w+)\/\w+\.log$
FORMAT = host::$1_$2
DEST_KEY = MetaData:Host

Re: Using multiple parameters for regexp host extraction

patrickprodoehl — Wed, 30 Sep 2020 04:40:39 GMT

awesome! works for me with two adaptions:

props.conf

[source::/data/reports/*/*/*.log]
TRANSFORMS-hostExtract = hostExtract

transforms.conf
[hostExtract]
SOURCE_KEY = MetaData:Source
REGEX = (\w+)\/(\w+)\/\w+.log$
FORMAT = host::$1_$2
DEST_KEY = MetaData:Host