Hi All,
I have log files in directory structure like this:
/var/log/data/index-a/logfile1.log
/var/log/data/index-b/logfile1.log
/var/log/data/index-c/logfile1.log
I want to dynamically set the index to the 4th element of the source path (i.e. index-a, index-b or index-c).
I have configured the following settings:
$SPLUNK_HOME/etc/system/local/inputs.conf
[monitor:///var/log]
disabled = false
followTail = 0
_blacklist = .(gz|zip|bkz|arch|trc)$
$SPLUNK_HOME/etc/system/local/props.conf
[source::.../var/log/data/.*]
TRANSFORMS-index = override-index
$SPLUNK_HOME/etc/system/local/transforms.conf
[override-index]
SOURCE_KEY = MetaData:Source
REGEX = /var/log/data/([^/]+)
FORMAT = $1
DEST_KEY = _MetaData:Index
However all log files are directed default main index.
have you tried to change the regex in the source stanza to something like this [source::.../var/log/data/...]
That seems to have resolved by issue. Thanks every much.