Getting Data In

passing source script file name in another field before indexing

premranjithj
Builder

i have a script which will be executed from inputs.conf but i need the script file name in a new field instead of source tag.
since i have a default source name configured. i want to add script file(source script) Name to the data indexed in the new field.

[script:///$SPLUNK_HOME/etc/apps/KIO/bin/Stats.py]
    interval = * * * * *
    source = siebel
    sourcetype = inflowstats
    disabled = False 
    index = index1
    host=server1
    Script=ScriptName
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust
0 Karma

to4kawa
SplunkTrust
SplunkTrust

how about ingest_eval or DEST_KEY in transforms.conf?

0 Karma

premranjithj
Builder

@to4kawa is it possible to hardcode the value ? to any new field

0 Karma

to4kawa
SplunkTrust
SplunkTrust

I don't know hardcode .
the field value is indexed as new value by settings.

0 Karma

premranjithj
Builder

@to4kawa how to do it new field creation with static value at transform.conf

0 Karma

to4kawa
SplunkTrust
SplunkTrust

https://answers.splunk.com/answers/817188/add-x-hours-to-epoch-time.html#answer-817198

this answer express to change source field value. it can create another field, also.

0 Karma

premranjithj
Builder

@to4kawa I tried this and not getting any results.

transforms.conf
 [myeval]
 INGEST_EVAL = ScriptName=python_script

 props.conf
 [testLog]
 TRANSFORMS = myeval

fields.conf
 [eval_city]
 INDEXED = True
0 Karma

to4kawa
SplunkTrust
SplunkTrust

INGEST_EVAL is eval
use "
and in props.conf, class name is needed.

0 Karma

premranjithj
Builder

@to4kawa is this correct to extract from source? i want to extract the file name alone. i want regex for this. please help

[extract-source]
SOURCE_KEY = MetaData:Source
FORMAT = job_id::$2
WRITE_META = true

source path will be etc/apps/bin/python.py

0 Karma

to4kawa
SplunkTrust
SplunkTrust

what's $2?
where's REGEX?

0 Karma

premranjithj
Builder

worked by adding default value in inputs.conf directly.
[script://path/your_script.py]
_meta = script_name::abc.py

0 Karma