Knowledge Management

Can I define permanent interpreting rules for specific directories?

leon12
Loves-to-Learn

Hey Guys, I have the following Event Data (Picture 1) that come into splunk via universal forwarder. I managed it to generate a table out of it (by using different operations like a delimiter by /n and the statements of picture 2). My Question is:

Can I define permanent interpreting rules for specific directories, so that the statements of picture 2 and the delimiter by /n are permanently apllicated for some specific directories?:)

 

Sincreley Leon

splunkt tabelle.PNG

 

 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @leon12,

at first the term "data Model" in Splunk means a different thing that you mean: a data Model is a table containing data extracted from events and archived in a MongoDB table, probably you are meaning "dataset".

Anyway, the parsing configurations are stored in props.conf and are fixed for that sourcetype.

props.conf must be located on the Indexers or, if present, on Heavy Forwarders.

Also the eval transformations can be inserted in the props.conf so you don't need to repeat them in eavery search.

The association between an input folder and a sourcetype is done by you in the inputs.conf.

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...