i have a script which will be executed from inputs.conf but i need the script file name in a new field instead of source tag.
since i have a default source name configured. i want to add script file(source script) Name to the data indexed in the new field.
[script:///$SPLUNK_HOME/etc/apps/KIO/bin/Stats.py]
interval = * * * * *
source = siebel
sourcetype = inflowstats
disabled = False
index = index1
host=server1
Script=ScriptName
how about ingest_eval
or DEST_KEY
in transforms.conf?
@to4kawa is it possible to hardcode the value ? to any new field
I don't know hardcode
.
the field value is indexed as new value by settings.
@to4kawa how to do it new field creation with static value at transform.conf
https://answers.splunk.com/answers/817188/add-x-hours-to-epoch-time.html#answer-817198
this answer express to change source
field value. it can create another field, also.
@to4kawa I tried this and not getting any results.
transforms.conf
[myeval]
INGEST_EVAL = ScriptName=python_script
props.conf
[testLog]
TRANSFORMS = myeval
fields.conf
[eval_city]
INDEXED = True
INGEST_EVAL
is eval
use "
and in props.conf, class name is needed.
@to4kawa is this correct to extract from source? i want to extract the file name alone. i want regex for this. please help
[extract-source]
SOURCE_KEY = MetaData:Source
FORMAT = job_id::$2
WRITE_META = true
source path will be etc/apps/bin/python.py
what's $2
?
where's REGEX?
worked by adding default value in inputs.conf directly.
[script://path/your_script.py]
_meta = script_name::abc.py