Is there a way at input time to omit the path of the file monitor to leave only the file names ?
path monitored :
/opt/csv/*
in the location - the files ..
filenameA.csv
filenameB.csv
filenameC.csv
filenameD.csv
but the source is alway prepended with the path.
/opt/csv/filenameA.csv
/opt/csv/filenameB.csv
can this be removed at input ?
gratzi
Hello @Skins,
This can be done at Parsing time using transforms.conf
[replacedefaultsource]
SOURCE_KEY = MetaData:Source
REGEX = \/opt\/csv\/(\w+.\w+)
DEST_KEY = MetaData:Source
FORMAT= source::$1
tried this exactly as above in transforms.conf and had no effect
splunk was restarted.
did you call it through props.conf?
Like:
[your_sourcetype]
TRANSFORMS-sourcename= replacedefaultsource