passing source script file name in another field before indexing

[DataOrg]

i have a script which will be executed from inputs.conf but i need the script file name in a new field instead of source tag.
since i have a default source name configured. i want to add script file(source script) Name to the data indexed in the new field.

[script:///$SPLUNK_HOME/etc/apps/KIO/bin/Stats.py]
    interval = * * * * *
    source = siebel
    sourcetype = inflowstats
    disabled = False 
    index = index1
    host=server1
    Script=ScriptName

[harsmarvania57]

Duplicate of https://answers.splunk.com/answers/818655/i-need-to-index-the-source-field-value-into-new-fi.html

[to4kawa]

how about ingest_eval or DEST_KEY in transforms.conf?

[DataOrg]

@to4kawa is it possible to hardcode the value ? to any new field

[to4kawa]

I don't know hardcode .
the field value is indexed as new value by settings.

[DataOrg]

@to4kawa how to do it new field creation with static value at transform.conf

[to4kawa]

https://answers.splunk.com/answers/817188/add-x-hours-to-epoch-time.html#answer-817198

this answer express to change source field value. it can create another field, also.

[DataOrg]

@to4kawa I tried this and not getting any results.

transforms.conf
 [myeval]
 INGEST_EVAL = ScriptName=python_script

 props.conf
 [testLog]
 TRANSFORMS = myeval

fields.conf
 [eval_city]
 INDEXED = True

[to4kawa]

INGEST_EVAL is eval
use "
and in props.conf, class name is needed.

[DataOrg]

@to4kawa is this correct to extract from source? i want to extract the file name alone. i want regex for this. please help

[extract-source]
SOURCE_KEY = MetaData:Source
FORMAT = job_id::$2
WRITE_META = true

source path will be etc/apps/bin/python.py

[to4kawa]

what's $2?
where's REGEX?

[DataOrg]

worked by adding default value in inputs.conf directly.
[script://path/your_script.py]
_meta = script_name::abc.py