Can I define permanent interpreting rules for specific directories?

[leon12]

Hey Guys, I have the following Event Data (Picture 1) that come into splunk via universal forwarder. I managed it to generate a table out of it (by using different operations like a delimiter by /n and the statements of picture 2). My Question is:

Can I define permanent interpreting rules for specific directories, so that the statements of picture 2 and the delimiter by /n are permanently apllicated for some specific directories?:)

Sincreley Leon

[gcusello]

Hi @leon12,

at first the term "data Model" in Splunk means a different thing that you mean: a data Model is a table containing data extracted from events and archived in a MongoDB table, probably you are meaning "dataset".

Anyway, the parsing configurations are stored in props.conf and are fixed for that sourcetype.

props.conf must be located on the Indexers or, if present, on Heavy Forwarders.

Also the eval transformations can be inserted in the props.conf so you don't need to repeat them in eavery search.

The association between an input folder and a sourcetype is done by you in the inputs.conf.

ciao.

Giuseppe