Getting Data In

How to use a Splunk forwarder directory name (segment) as an event tag?

lsparrow
New Member

Hello!

I was wondering how to use a directory name (segment) as an event tag. For example:

C:\bin\code\python\test_system\scoring\results\16\17055079037\some files log files here or in directory's below this.

The system outputs many hundreds of directories at the 17055079037 level. I don't want to segment on host, source, or sourcetype (as I have manually defined these to cut the console spam). I'd just want the 17055079037 level to be reported as an event attribute, so when I open the error log within Splunk, I can readably see that the log file originated from the 17055079037 directory.

I am guessing this is something to do with segmentation, but I don't know how to configure the inputs.conf for this.

Any suggestions gratefully received.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can extract fields from other fields, in this case from source:

props.conf
[sourcetype, source, or host stanza]
EXTRACT-level = ^(?:[^\\]+\\){8}(?<level>[^\\]+) in source

That would give you a field level set to the segment after the eighth backslash.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can extract fields from other fields, in this case from source:

props.conf
[sourcetype, source, or host stanza]
EXTRACT-level = ^(?:[^\\]+\\){8}(?<level>[^\\]+) in source

That would give you a field level set to the segment after the eighth backslash.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...