Getting Data In

How to rename a sourcetype based on the source on my indexer within a custom app?

ugruner
Explorer

Hi, I am trying to rename a sourcetype based on the source on my indexer within a custom app

so i created props.conf and transforms.conf in %splunkhome%\etc\apps\myapp\default

props.conf

[source::C:\\temp\\MyFile*.csv]
TRANSFORMS-wst=wst-sourcetype

transforms.conf

[wisdom-sourcetype]
DEST_KEY=MetaData:Sourcetype
SOURCE_KEY=MetaData:Source
REGEX=\bMyFile\w+
FORMAT=sourcetype::$1
WRITE_META=true

Any idea why I still get the Sourcetype in csv?

0 Karma
1 Solution

FrankVl
Ultra Champion

In the FORMAT setting, you use $1, which refers to the first capturing group in the REGEX, but the REGEX does not contain any capturing group.

View solution in original post

0 Karma

FrankVl
Ultra Champion

In the FORMAT setting, you use $1, which refers to the first capturing group in the REGEX, but the REGEX does not contain any capturing group.

0 Karma

ugruner
Explorer

Shame on me. For missing the ().
Thanks.

0 Karma

ugruner
Explorer

sorry there was a copy and paste error: it should be wst-sourcetype not wisdom-sourcetype in transforms.conf

transforms.conf is
[wst-sourcetype]
DEST_KEY=MetaData:Sourcetype
SOURCE_KEY=MetaData:Source
REGEX=\bMyFile\w+
FORMAT=sourcetype::$1
WRITE_META=true

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...