Creating a CSV file with host, index, sourcetype, source, and sourcepath (monitor), how do I extract the monitor field in a search?

[splunkvickyloui]

Hi,

I have inputs.conf with below configuration details:

[monitor:///data02/appserver/jboss2/prod-ABCD-domain/servers/prod-ABCD-node02/log/access_log*]
sourcetype=jboss_server_access
source=ABCD_jboss_prod_accesslog_node2
index=prod_ABCD_jboss
ignoreOlderThan=1d

I would like to create one CSV file with all details like host, index, sourcetype, source, and sourcepath (monitor). I am able to retrieve the details of source, sourcetype by using values(). How shall I retrieve the value of monitor (remote path and file name)

 * | stats values(source), values(sourcetype) by host index

Thanks

[badrinath_itrs]

Hi,

Can you extract the file name from internal index data itself.

index=_internal sourcetype=splunkd "monitor" | rex "monitor:(?<FilesMonitored>[^\n\r]+)"

I am not good with regex, but give a try .

[splunkvickyloui]

Hi Badri,

Thanks. It filters correctly. I appreciate your help. Now I am struggling to combine both the searches

index=_internal sourcetype=splunkd "monitor" | rex "monitor:(?[^\n\r]+)"
and
* | stats values(source), values(sourcetype) by host index

I am expecting the results in a table format

Host, Index, Sourcetype, Source, FilesMonitored

[hortonew]

Generally speaking, it's not recommended to set your own "source" in inputs.conf. If you leave that part out, Splunk will automatically set the "source" field to the file that it monitored.

[splunkvickyloui]

Hi hortonew,

Thanks. As you said, it works if I am not setting any name for "source". But I am wondering how come it displays(even if I set source) the file path and names in deployment server - /en-US/manager/search/deploymentsetup/app/data/inputs/remote_monitor?app_only=False&offset=0

Source path Host
/data01/home/jbservice/logs/exp_fct_inv_criteria_temp_201* None
/data01/home/jbservice/logs/imp_fct_inv_criteria_temp_201* None
/data01/home/jbservice/logs/imp_fct_inv_criteria_temp_201* None