Renaming sources for charting purposes

[ericrobinson]

Hello, I have a chart that show event counts split by source name. For our analysis, it is very important that we see the source names. Because of the long path, the important part is .....

e.g.

/opt/applocal/fs/dir/Log.log

shows as

/opt/applocal......log

Is there anything from Splunk Web I can do to improve the chart?

[Lowell]

The replace search command is really helpful here too. It's a little less flexible than the rex approach, but it can also be much simpler to use. (And there's no reason why you can't do both for different types of source names.)

Here is an example I grabbed from one of my saved searches with source renaming:

... | replace "*var*log*splunk*metrics.log*" with "splunk/metrics.log" "/stage/logs/*" with "/stage/logs/LOGFILE" "*var*log*splunk*splunkd.log*" with "splunk/splunkd.log" "/common/log/prefix/*.log" with "*.log" in source | ...

[zscgeek]

You could use the rex command to rewrite the source field.

... | rex field=source "/(?<sourcefile>[^/]+?)$" | timechart count by sourcefile 

That will transform a source that looks like "/opt/applocal/fs/dir/Log.log" to a field called sourcefile like "Log.log"