Getting Data In

Renaming sources for charting purposes

Path Finder

Hello, I have a chart that show event counts split by source name. For our analysis, it is very important that we see the source names. Because of the long path, the important part is .....



shows as


Is there anything from Splunk Web I can do to improve the chart?

Tags (1)

Super Champion

The replace search command is really helpful here too. It's a little less flexible than the rex approach, but it can also be much simpler to use. (And there's no reason why you can't do both for different types of source names.)

Here is an example I grabbed from one of my saved searches with source renaming:

... | replace "*var*log*splunk*metrics.log*" with "splunk/metrics.log" "/stage/logs/*" with "/stage/logs/LOGFILE" "*var*log*splunk*splunkd.log*" with "splunk/splunkd.log" "/common/log/prefix/*.log" with "*.log" in source | ...

Path Finder

You could use the rex command to rewrite the source field.

... | rex field=source "/(?<sourcefile>[^/]+?)$" | timechart count by sourcefile 

That will transform a source that looks like "/opt/applocal/fs/dir/Log.log" to a field called sourcefile like "Log.log"