Hi ,
Is there any way I can simply have Plprdfinodm01
as my Source in Splunk which indicates JVM name?
D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log
D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log
D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log
D:\splunk\waslp\vxpip-ppm02\PIprdfinodm01\messages.log
Or..you could overwrite the source...
If your sourcetype was called "jvm-log", you'd have a props.conf entry for the sourcetype, identifying the transform rule.
[jvm-log]
TRANSFORMS-1_source = force_jvm_source
This references a rule that would be defined in transforms.conf:
[force_jvm_source]
SOURCE_KEY =_raw
REGEX =.*\\([^\\]+)\\messages.log
DEST_KEY = MetaData:Source
FORMAT = source::$1
I think personally I would create a new field (field extraction) called something like JVMHost. That way you preserve the original data.
You could use a regex like this:
.*\\(?<JVMHost>[^\\]+)\\messages.log