Splunk Search

Create a field from the source

splunkbee
New Member

Hi,

I have created fields from the raw data successfully. However now I need to extract a portion of the source data (which I imported manually into my Splunk running on a Mac) and create one field.
My source data are actually multiple files that contains log and the machine identifiers is in the source path
Exemple:
splunk_data.zip:./var/www/temp/GetOnline/CG1111/MD/LOG.TXT
splunk_data.zip:./var/www/temp/GetOnline/UV5015/MD/LOG.TXT

The correct regex to extract the machine name would be: (?<=ne\/).*?(?=\/MD)

I have tried all possible answers from that forum and I could not create a field t.hat would include all my machine names.

I was wondering if you guys can shed some light here?

Thanks.

0 Karma

splunkbee
New Member

Thanks for your answer.

I've done what you suggested but it doesn't work. I have three questions:

1) There are a lot of props.conf and transforms.conf on my Mac. I created these two files under /Application/Splunk/etc/system/local and I populated them with your inputs above. Is that right?

2) In your props.conf above, what would be the correct value for "yoursourcetype"?

3) Then what? Restart Splunk? Restart my Mac? Re-index?

Thanks

0 Karma

micahkemp
Champion

1) Which props/trasnforms files you alter may depend on your other configurations. You can use btool to ensure the configurations you create are being handled as you want them.

2) That depends on what sourcetype the data is created with. When you search for this data in your Splunk instance, what do you see for the sourcetype?

3) You should not need to re-index, but you should at least perform a debug/refresh (yoursplunkhost:8000/debug/refresh, and click the button that is shown there) to inform Splunk to re-read its configuration.

0 Karma

micahkemp
Champion

Try this.

props.conf:

[<yoursourcetype>]
REPORT-machinename = machinename

transforms.conf:

[machinename]
SOURCE_KEY = MetaData:Source
REGEX = (?<=ne\/)(?<machinename>.*)?(?=\/MD)
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...