Deployment Architecture

How do I trim field names in a custom Add-On?


I've created an Add-On for my workplace that collects the serial numbers of motherboards and local drives. I've constructed the scripts to send this information back in a key=value format. Everything works great as data is fed back to the indexing server from the Universal Forwarder and I can search for the data without issues. Now, I'd like to trim the field names from showing up in the search results, but I'd like to program that into the Add-On.

For example, local drive serial numbers are saved as the sourcetype diskserial and motherboard serial numbers as systemserial. So if I search for either of these, ex. sourcetype=diskserial, the results show up as:

     diskserial     |      host
diskserial=abc12345 |
diskserial=def67890 |

I'd like for the diskserial= to be automagically trimmed off. This would make the output much cleaner and make report generation much easier for our admins. My understanding is that I have to include some kind of Regex in the props.conf file, but I'm not sure how that's supposed to work.

0 Karma


To clarify, this is an Add-On that gets pushed to workstations, i.e. all machines with the UniversalForwarder installed. The props.conf file would be the one included in the Add-On, not the UniversalForwarder props.conf or server-sided props.conf. I'm trying to package everything into the Add-On to make it as convenient as possible.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...