i need to index the source field value into new fields during index time

[DataOrg]

please help me in indexing source field value into new fields value during index time.
please help with transform/props.conf
i need to extract the source field only the script name with the new field.

source field value will be /splunk_home/etc/apps/bin/python.py

[harsmarvania57 · Accepted solution]

Hi,

Please try below config on Indexer/Heavy Forwarder whichever comes first from UF.

props.conf

[yoursourcetype]
TRANSFORMS-sourceextract = get_script_from_source

transforms.conf

[get_script_from_source]
SOURCE_KEY = MetaData:Source
REGEX = ([^\/]+$)
FORMAT = script_name::$1
WRITE_META=true

On Search Head

fields.conf

[script_name]
INDEXED = true

[DataOrg]

@harsmarvania57 not working.
error captured at splunkd.log

04-22-2020 10:18:56.823 +0000 ERROR regexExtractionProcessor - REGEX field must be specified tranform_name=route_script_pg_thingworx

[harsmarvania57]

There was typo in transforms.conf configuration, it should be SOURCE_KEY = MetaData:Source , not Metadata:Source. I have updated my answer with correct configuration.

[DataOrg]

@harsmarvania57 thanks its worked but it not picking a metadata value.
i want to create a new field with static value(hardcoded value). how to create it ?
script_name = abc.py

[harsmarvania57]

What do you mean by "metadata value" ? You mentioned in your question that you want to create new indexed time field based on source and now you are saying that you want to hardcode the value at index time, I am confused now. Please clarify what you want to achieve.

[DataOrg]

i want to create a field with hard-corded script name value during index time itself since i cant use source field it was pointing something,

[harsmarvania57]

Remove above props & transforms config and try below configuration on UF

inputs.conf

[script://path/your_script.py]
_meta = script_name::abc.py

[DataOrg]

@harsmarvania57 thanks , it worked

[harsmarvania57]

Welcome ..