How to set Source equal to filename in input.conf?

[moaf13]

There are a lot of documentation on how to set Host equal to filename or directory name, however i couldn't find anything on how to set source equal to file name?

[monitor://.......\fil.log]
disabled=0
source=???
sourcetype= logFile

props.conf

[logFile]
setting
.
.
.

[somesoni2 · Accepted solution]

Try this as the REGEX in your transforms.conf

[replacedefaultsource]
SOURCE_KEY = MetaData:Source
REGEX = E:\\Users\\([^\\]+)\\fil.txt
DEST_KEY = MetaData:Source
FORMAT= source::$1

[moaf13]

Thank you very much. That's exactly what i was looking for.

I also added another change which was removing [source::E:\Users\Documents\fil.txt] entirly from props.conf and moving TRANSFORMS-replace_source to sourcetype setting for anyone looking at this answer in the future.

[WindowsFile]
bunch of setting.....
TRANSFORMS-replace_source = replacedefaultsource

removed ([source::E:\Users\Documents\fil.txt]
TRANSFORMS-replace_source = replacedefaultsource)

Do you know why I had to do that? does splunk prioritize sourcetype setting than other settings in props.conf?

[sundareshr]

The source of an event is the name of the file, stream, or other input from which the event originates. For data monitored from files and directories, the value of source is the full path, such as /archive/server1/var/log/messages.0 or /var/log/. The value of source for network-based data sources is the protocol and port, such as UDP:514

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Aboutdefaultfields

[moaf13]

Thank you for answering, but this is what I have

[monitor://E:\Users\Documents\fil.txt]
disabled=0
Sourcetype = WindowsFile
queue = parsingQueue

props.conf

[WindowsFile]
bunch of setting.....

[source::E:\Users\Documents\fil.txt]
TRANSFORMS-replace_source = replacedefaultsource

Tranforms.conf

[replacedefaultsource]
SOURCE_KEY = MetaData:Source
REGEX = E:\Users\(Documents)\fil.txt
DEST_KEY = MetaData:Source
FORMAT= source::$1

That's the setting that i have and it's not working, I don't want to full path, I just want the filename. this is what i have and it's not working?