Extracting sourcetype from source /tmp/csv/file1

[hylam]

The sourcetype should be csv or tsv or psv, depending on the full path in the source field. For hosts we have host_regex and host_segment. Do we have sourcetype_regex or sourcetype_segment? Thx.

/tmp/csv/file1
/tmp/csv/file2
/tmp/tsv/file3
/tmp/tsv/file4
/tmp/psv/file5
/tmp/psv/file6

[esix_splunk · Accepted solution]

We dont have this ability now in Splunk. However, you can further filter the sourcetype by source via transforms and searching a regex against the meta data. This article has a good example -

https://answers.splunk.com/answers/112471/changing-sourcetype-with-regex.html