Splunk Search

Creating a CSV file with host, index, sourcetype, source, and sourcepath (monitor), how do I extract the monitor field in a search?

splunkvickyloui
Explorer

Hi,

I have inputs.conf with below configuration details:

[monitor:///data02/appserver/jboss2/prod-ABCD-domain/servers/prod-ABCD-node02/log/access_log*]
sourcetype=jboss_server_access
source=ABCD_jboss_prod_accesslog_node2
index=prod_ABCD_jboss
ignoreOlderThan=1d

I would like to create one CSV file with all details like host, index, sourcetype, source, and sourcepath (monitor). I am able to retrieve the details of source, sourcetype by using values(). How shall I retrieve the value of monitor (remote path and file name)

 * | stats values(source), values(sourcetype) by host index

Thanks

0 Karma

badrinath_itrs
Communicator

Hi,

Can you extract the file name from internal index data itself.

index=_internal sourcetype=splunkd "monitor" | rex "monitor:(?<FilesMonitored>[^\n\r]+)"

I am not good with regex, but give a try .

0 Karma

splunkvickyloui
Explorer

Hi Badri,

Thanks. It filters correctly. I appreciate your help. Now I am struggling to combine both the searches

index=_internal sourcetype=splunkd "monitor" | rex "monitor:(?[^\n\r]+)"
and
* | stats values(source), values(sourcetype) by host index

I am expecting the results in a table format

Host, Index, Sourcetype, Source, FilesMonitored

0 Karma

hortonew
Builder

Generally speaking, it's not recommended to set your own "source" in inputs.conf. If you leave that part out, Splunk will automatically set the "source" field to the file that it monitored.

0 Karma

splunkvickyloui
Explorer

Hi hortonew,

Thanks. As you said, it works if I am not setting any name for "source". But I am wondering how come it displays(even if I set source) the file path and names in deployment server - /en-US/manager/search/deploymentsetup/app/data/inputs/remote_monitor?app_only=False&offset=0

Source path Host
/data01/home/jbservice/logs/exp_fct_inv_criteria_temp_201* None
/data01/home/jbservice/logs/imp_fct_inv_criteria_temp_201* None
/data01/home/jbservice/logs/imp_fct_inv_criteria_temp_201* None

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...