Getting Data In

How to use a Splunk forwarder directory name (segment) as an event tag?

New Member

Hello!

I was wondering how to use a directory name (segment) as an event tag. For example:

C:\bin\code\python\test_system\scoring\results\16\17055079037\some files log files here or in directory's below this.

The system outputs many hundreds of directories at the 17055079037 level. I don't want to segment on host, source, or sourcetype (as I have manually defined these to cut the console spam). I'd just want the 17055079037 level to be reported as an event attribute, so when I open the error log within Splunk, I can readably see that the log file originated from the 17055079037 directory.

I am guessing this is something to do with segmentation, but I don't know how to configure the inputs.conf for this.

Any suggestions gratefully received.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can extract fields from other fields, in this case from source:

props.conf
[sourcetype, source, or host stanza]
EXTRACT-level = ^(?:[^\\]+\\){8}(?<level>[^\\]+) in source

That would give you a field level set to the segment after the eighth backslash.

View solution in original post

SplunkTrust
SplunkTrust

You can extract fields from other fields, in this case from source:

props.conf
[sourcetype, source, or host stanza]
EXTRACT-level = ^(?:[^\\]+\\){8}(?<level>[^\\]+) in source

That would give you a field level set to the segment after the eighth backslash.

View solution in original post

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!