Getting Data In
Highlighted

Renaming sources for charting purposes

Path Finder

Hello, I have a chart that show event counts split by source name. For our analysis, it is very important that we see the source names. Because of the long path, the important part is .....

e.g.

/opt/applocal/fs/dir/Log.log

shows as

/opt/applocal......log

Is there anything from Splunk Web I can do to improve the chart?

Tags (1)
Highlighted

Re: Renaming sources for charting purposes

Path Finder

You could use the rex command to rewrite the source field.

... | rex field=source "/(?<sourcefile>[^/]+?)$" | timechart count by sourcefile 

That will transform a source that looks like "/opt/applocal/fs/dir/Log.log" to a field called sourcefile like "Log.log"

Highlighted

Re: Renaming sources for charting purposes

Super Champion

The replace search command is really helpful here too. It's a little less flexible than the rex approach, but it can also be much simpler to use. (And there's no reason why you can't do both for different types of source names.)

Here is an example I grabbed from one of my saved searches with source renaming:

... | replace "*var*log*splunk*metrics.log*" with "splunk/metrics.log" "/stage/logs/*" with "/stage/logs/LOGFILE" "*var*log*splunk*splunkd.log*" with "splunk/splunkd.log" "/common/log/prefix/*.log" with "*.log" in source | ...
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.