Hi,
I have a folder with 10 XML files and it can be more in the future.
My requirement is to upload this file, and the sourcetype name should be equal to name of file.
I want everything to be automatic.
For that, do I need to use a python script or can it be done by Splunk?
Is there any tutorial link for creating a sourcetype and uploading the file through a python script?
Thanks.
You can do it in Splunk by using props.conf
and transforms.conf
like this (be sure not to set a sourcetype=
in your inputs.conf
😞
#props.conf:
[source::<your stuff here>]
TRANSFORMS-sourcetypeSetFromFilename=sourcetypeSetFromFilename
Then
#transforms.conf:
[sourcetypeSetFromFilename]
SOURCE_KEY = MetaData:Source
REGEX = <your RegEx here with one capture group>
FORMAT = sourcetype::$1
DEST_KEY = MetaData:Sourcetype
You can do it in Splunk by using props.conf
and transforms.conf
like this (be sure not to set a sourcetype=
in your inputs.conf
😞
#props.conf:
[source::<your stuff here>]
TRANSFORMS-sourcetypeSetFromFilename=sourcetypeSetFromFilename
Then
#transforms.conf:
[sourcetypeSetFromFilename]
SOURCE_KEY = MetaData:Source
REGEX = <your RegEx here with one capture group>
FORMAT = sourcetype::$1
DEST_KEY = MetaData:Sourcetype
Hi,
I am getting it.
here is my pros file
My files are in splunk-input fiolder in local computer.
[source::/opt/splunk-input/]
TRANSFORMS-sourcetypeSetFromFilename=sourcetypeSetFromFilename
here is my transform file
#transforms.conf:
[sourcetypeSetFromFilename]
SOURCE_KEY = MetaData:Source
REGEX = .\/(.)
FORMAT = sourcetype::$1
DEST_KEY = MetaData:Sourcetype
i copied both files in splunk/etc/system/local folder
And i am uploading files through setting->data->new
and for sourcetype i selected automatic.
I don't think it will work with [source::/opt/splunk-input/]
; you need to use something with wildcards
like [source::/opt/splunk-input/*]
, otherwise it will not match any of your sources. Other than that, it should work, once you bounce your forwarders.
Thanx for rply,
That regex in transforms.conf is to set the name of sourcetype? or for something else?
And if i will upload a folder with all the file through settings-->data input , sourcetype will be equal to folder name and one for all the files? or each file will have there sourcetype?
for example i have file 1 , file 2, file 3 in a folder name file. my requirement is to have three sourcetype with name file 1, file2, file 3.
but dont want to upload each file one by one.
Right, if you need to use the filename as the sourcetype, you use a RegEx like this:
REGEX = .*\/(.*)