Getting Data In

How to map a sourcetype based on the values in the event?

a212830
Champion

Hi,

I have some nicely defined logfiles, with all key-value pair entries. We'd like to create dynamic sourcetypes, based upon one of the values in the event. Is this possible?

0 Karma

somesoni2
Revered Legend
0 Karma

javiergn
Super Champion

Yes, see this:

http://docs.splunk.com/Documentation/Splunk/6.3.3/Data/Advancedsourcetypeoverrides

Example 1 (static sourcetype name):

[set_sourcetype_my_log_for_some_hosts]
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(host1|host2|host3)[\w\.\-]*\]?\s
FORMAT = sourcetype::my_log
DEST_KEY = MetaData:Sourcetype

Example 2 (dynamic host name but you can apply the same logic to MetaData:Sourcetype):

[syslog-host]
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(\w[\w\.\-]{2,})\]?\s
FORMAT = host::$1
DEST_KEY = MetaData:Host
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...