Getting Data In

How to rename a sourcetype based on the source on my indexer within a custom app?

Explorer

Hi, I am trying to rename a sourcetype based on the source on my indexer within a custom app

so i created props.conf and transforms.conf in %splunkhome%\etc\apps\myapp\default

props.conf

[source::C:\\temp\\MyFile*.csv]
TRANSFORMS-wst=wst-sourcetype

transforms.conf

[wisdom-sourcetype]
DEST_KEY=MetaData:Sourcetype
SOURCE_KEY=MetaData:Source
REGEX=\bMyFile\w+
FORMAT=sourcetype::$1
WRITE_META=true

Any idea why I still get the Sourcetype in csv?

0 Karma
1 Solution

Ultra Champion

In the FORMAT setting, you use $1, which refers to the first capturing group in the REGEX, but the REGEX does not contain any capturing group.

View solution in original post

0 Karma

Ultra Champion

In the FORMAT setting, you use $1, which refers to the first capturing group in the REGEX, but the REGEX does not contain any capturing group.

View solution in original post

0 Karma

Explorer

Shame on me. For missing the ().
Thanks.

0 Karma

Explorer

sorry there was a copy and paste error: it should be wst-sourcetype not wisdom-sourcetype in transforms.conf

transforms.conf is
[wst-sourcetype]
DESTKEY=MetaData:Sourcetype
SOURCE
KEY=MetaData:Source
REGEX=\bMyFile\w+
FORMAT=sourcetype::$1
WRITE_META=true

0 Karma