Splunk Enterprise

log different field based on sourcetype

John_Zheng
Engager

Hi, I am using splunk otel,  send log to splunk enterprise.For different sourcetype, I want to do different thing, like add field, remove fields

can you guide me, thanks a lot.

 

For below, it work.

```
      transform/istio-proxy:
        error_mode: ignore
        log_statements:
        - context: log
          statements:
          - set(attributes["johnaddkey"], "johnaddvalue")

```

 

For below, it does not work.

```
      transform/istio-proxy:
        error_mode: ignore
        log_statements:
        - context: log
          statements:
          - set(attributes["johntestwhere"], "johnvaluewhere") where attributes["sourcetype"]
            == "kube:container:istio-proxy"

```

For below, it does not work.

```
      transform/istio-proxy:
        error_mode: ignore
        log_statements:
        - context: log
          conditions:
          - attributes["sourcetype"] == "kube:container:istio-proxy"
          statements:
          - set(attributes["johnaddkeyc"], "johnaddvaluec") 

```

 

John_Zheng_0-1734993721840.png

 

Labels (1)
0 Karma
1 Solution

John_Zheng
Engager

Ok, finically I figured out by myself.

Here is correct code

```

transform/istio-proxy:
error_mode: ignore
log_statements:
- context: log
statements:
- keep_keys(resource.attributes, ["_time", "cluster_codename", "host.name", "com.splunk.index", "splunk_server", "com.splunk.source", "com.splunk.sourcetype"]) where resource.attributes["com.splunk.sourcetype"]
== "kube:container:istio-proxy"
- delete_key(attributes, "logtag") where resource.attributes["com.splunk.sourcetype"]
== "kube:container:istio-proxy"

``` 

The point is should use resource.attributes["com.splunk.sourcetype"]

instead of  attributes["sourcetype"] 

View solution in original post

0 Karma

John_Zheng
Engager

Ok, finically I figured out by myself.

Here is correct code

```

transform/istio-proxy:
error_mode: ignore
log_statements:
- context: log
statements:
- keep_keys(resource.attributes, ["_time", "cluster_codename", "host.name", "com.splunk.index", "splunk_server", "com.splunk.source", "com.splunk.sourcetype"]) where resource.attributes["com.splunk.sourcetype"]
== "kube:container:istio-proxy"
- delete_key(attributes, "logtag") where resource.attributes["com.splunk.sourcetype"]
== "kube:container:istio-proxy"

``` 

The point is should use resource.attributes["com.splunk.sourcetype"]

instead of  attributes["sourcetype"] 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...