Getting Data In

How to set a string in my current source field value as the source in Splunk?

harishnpandey
Explorer

Hi ,

Is there any way I can simply have Plprdfinodm01 as my Source in Splunk which indicates JVM name?

D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log    
D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log
D:\splunk\waslp\vxpip-ppm02\PIprdfinodm01\messages.log

alt text

0 Karma

livehybrid
Ultra Champion

Or..you could overwrite the source...

If your sourcetype was called "jvm-log", you'd have a props.conf entry for the sourcetype, identifying the transform rule.

 [jvm-log]
 TRANSFORMS-1_source = force_jvm_source

This references a rule that would be defined in transforms.conf:

 [force_jvm_source]
 SOURCE_KEY =_raw
 REGEX =.*\\([^\\]+)\\messages.log
 DEST_KEY = MetaData:Source
 FORMAT = source::$1
0 Karma

livehybrid
Ultra Champion

I think personally I would create a new field (field extraction) called something like JVMHost. That way you preserve the original data.
You could use a regex like this:
.*\\(?<JVMHost>[^\\]+)\\messages.log

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...