Knowledge Management

Can I define permanent interpreting rules for specific directories?


Hey Guys, I have the following Event Data (Picture 1) that come into splunk via universal forwarder. I managed it to generate a table out of it (by using different operations like a delimiter by /n and the statements of picture 2). My Question is:

Can I define permanent interpreting rules for specific directories, so that the statements of picture 2 and the delimiter by /n are permanently apllicated for some specific directories?:)


Sincreley Leon

splunkt tabelle.PNG



Labels (2)
0 Karma

Esteemed Legend

Hi @leon12,

at first the term "data Model" in Splunk means a different thing that you mean: a data Model is a table containing data extracted from events and archived in a MongoDB table, probably you are meaning "dataset".

Anyway, the parsing configurations are stored in props.conf and are fixed for that sourcetype.

props.conf must be located on the Indexers or, if present, on Heavy Forwarders.

Also the eval transformations can be inserted in the props.conf so you don't need to repeat them in eavery search.

The association between an input folder and a sourcetype is done by you in the inputs.conf.



0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...