Getting Data In

Problems with setting sourcetype through transformations.conf

Path Finder

This is driving me mad - have gone through the documentation and responses to queries in here but still can't get sourcetype overrided by using a transform. I'm missing something, I'm guessing obvious, but not obvious to me!


disabled = 0  
followTail = 0  
index = automationlogs  


TRANSFORMS-set_sourcetype_for_scriptlogs = set_sourcetype_for_scriptlogs  
priority = 10  


SOURCE_KEY = MetaData:Source  
DEST_KEY = MetaData:Sourcetype  
REGEX = .*/(.*?)\..*  
FORMAT = Sourcetype::$1  
0 Karma


Are you trying to extract the sourcetype out of the source field value?

i.e. ---> /Users/admin/Documents/splunkDataToIndex/automation_logs/

If so, your regex isnt matching anything.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!