please help me in indexing source field value into new fields value during index time.
please help with transform/props.conf
i need to extract the source field only the script name with the new field.
source field value will be /splunk_home/etc/apps/bin/python.py
Hi,
Please try below config on Indexer/Heavy Forwarder whichever comes first from UF.
props.conf
[yoursourcetype]
TRANSFORMS-sourceextract = get_script_from_source
transforms.conf
[get_script_from_source]
SOURCE_KEY = MetaData:Source
REGEX = ([^\/]+$)
FORMAT = script_name::$1
WRITE_META=true
On Search Head
fields.conf
[script_name]
INDEXED = true
Hi,
Please try below config on Indexer/Heavy Forwarder whichever comes first from UF.
props.conf
[yoursourcetype]
TRANSFORMS-sourceextract = get_script_from_source
transforms.conf
[get_script_from_source]
SOURCE_KEY = MetaData:Source
REGEX = ([^\/]+$)
FORMAT = script_name::$1
WRITE_META=true
On Search Head
fields.conf
[script_name]
INDEXED = true
@harsmarvania57 not working.
error captured at splunkd.log
04-22-2020 10:18:56.823 +0000 ERROR regexExtractionProcessor - REGEX field must be specified tranform_name=route_script_pg_thingworx
There was typo in transforms.conf configuration, it should be SOURCE_KEY = MetaData:Source
, not Metadata:Source
. I have updated my answer with correct configuration.
@harsmarvania57 thanks its worked but it not picking a metadata value.
i want to create a new field with static value(hardcoded value). how to create it ?
script_name = abc.py
What do you mean by "metadata value" ? You mentioned in your question that you want to create new indexed time field based on source and now you are saying that you want to hardcode the value at index time, I am confused now. Please clarify what you want to achieve.
i want to create a field with hard-corded script name value during index time itself since i cant use source field it was pointing something,
Remove above props & transforms config and try below configuration on UF
inputs.conf
[script://path/your_script.py]
_meta = script_name::abc.py
@harsmarvania57 thanks , it worked
Welcome ..