Splunk Dev

remove path from source to only show file name for file monitor input

Skins
Path Finder

Is there a way at input time to omit the path of the file monitor to leave only the file names ?

path monitored :

/opt/csv/*

in the location - the files ..

filenameA.csv
filenameB.csv
filenameC.csv
filenameD.csv

but the source is alway prepended with the path.

/opt/csv/filenameA.csv
/opt/csv/filenameB.csv

can this be removed at input ?

gratzi

Tags (1)
0 Karma

vishaltaneja070
Motivator

Hello @Skins,

This can be done at Parsing time using transforms.conf
[replacedefaultsource]
SOURCE_KEY = MetaData:Source
REGEX = \/opt\/csv\/(\w+.\w+)
DEST_KEY = MetaData:Source
FORMAT= source::$1

0 Karma

Skins
Path Finder

tried this exactly as above in transforms.conf and had no effect

splunk was restarted.

0 Karma

vishaltaneja070
Motivator

did you call it through props.conf?

Like:
[your_sourcetype]
TRANSFORMS-sourcename= replacedefaultsource

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...