My question concerns the "website Input" modular input. Is it possible to have examples of how to fulfil the "Output" section of a new "Web-pages" data input, please?
The current hint displayed is not clear enough for me (who am not an expert): "The value of the field name will be set to the value of the attribute in the matching element; enter multiple attributes separated by commas".
Thanks in advance,
Emmanuel.
Short answer: you can usually leave it empty.
Long answer: you can set this in order to assign the field names (that are provided to Splunk) based on content within the web-page you are matching.
For example, consider the following HTML:
<div id="model">Focus</div>
<div name="submodel">ST</div>
<div name="make" id="car">Ford</div>
Assuming you have the CSS selector set such that it matches all "div" tags, you would get the following output:
match=Focus match=ST match=Ford
The matches do not distinguish which div tag was set (cannot tell which field is the model, submodel or make). If the setting of the name attributes is "name", then the app would look for the "name" attribute and use that as the name. This results in:
match=Focus submodel=ST make=Ford
You can use multiple names too. In the example above, it makes sense to use "id" too. This can be done by setting the name attributes to "name,id", This would cause the following output with the example above:
model=Focus submodel=ST make=Ford
Now, the fields have names that distinguish what they are. Note that it uses the first match it finds. That means it will look for "name" first and then "id" when the setting is "name,id".
Helpful hint: A good way to test this is to use the "Preview results" link on the web-pages input page to test run your input and see what the output would look like.