Deployment Architecture

How do I trim field names in a custom Add-On?


I've created an Add-On for my workplace that collects the serial numbers of motherboards and local drives. I've constructed the scripts to send this information back in a key=value format. Everything works great as data is fed back to the indexing server from the Universal Forwarder and I can search for the data without issues. Now, I'd like to trim the field names from showing up in the search results, but I'd like to program that into the Add-On.

For example, local drive serial numbers are saved as the sourcetype diskserial and motherboard serial numbers as systemserial. So if I search for either of these, ex. sourcetype=diskserial, the results show up as:

     diskserial     |      host
diskserial=abc12345 |
diskserial=def67890 |

I'd like for the diskserial= to be automagically trimmed off. This would make the output much cleaner and make report generation much easier for our admins. My understanding is that I have to include some kind of Regex in the props.conf file, but I'm not sure how that's supposed to work.

0 Karma


To clarify, this is an Add-On that gets pushed to workstations, i.e. all machines with the UniversalForwarder installed. The props.conf file would be the one included in the Add-On, not the UniversalForwarder props.conf or server-sided props.conf. I'm trying to package everything into the Add-On to make it as convenient as possible.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...