Splunk Search

change sourcetype for sourcetype not starting with specific word

ss026381
Communicator

I want to change the sourcetype for all incoming logs with sourcetypes not starting with abc. I have following setting but it would change it for all the sourcetypes

  #Transforms.conf on indexer

  [noncerner:setnull]
  SOURCE_KEY = MetaData:Sourcetype
  REGEX = (?::){0}^(?!ABC).*
  #REGEX = ^(?!ABC).* tried it
  #REGEX = sourcetype::^(?!ABC).* tried it
  #REGEX = sourcetype::(?::)^(?!ABC).* tried it
  DEST_KEY = MetaData:Sourcetype
  FORMAT = sourcetype::ABC:temp:logs

Any hep is appreciated.

0 Karma
1 Solution

tiagofbmm
Influencer

This is the syntax for what you want to do. Let me know

[noncerner:setnull]
FORMAT = sourcetype::ABC:temp:logs
DEST_KEY = MetaData:Sourcetype
SOURCE_KEY = MetaData:Sourcetype
REGEX = sourcetype::(((?!abc)).*)

View solution in original post

tiagofbmm
Influencer

This is the syntax for what you want to do. Let me know

[noncerner:setnull]
FORMAT = sourcetype::ABC:temp:logs
DEST_KEY = MetaData:Sourcetype
SOURCE_KEY = MetaData:Sourcetype
REGEX = sourcetype::(((?!abc)).*)

ss026381
Communicator

Very big thumps up, it worked, thanks. I am testing few more scenarios and will comment later today.

0 Karma

tiagofbmm
Influencer

^((?!abc).)*

This regex shall negate the string exists.

0 Karma

ss026381
Communicator

there is no problem with the regex. it works when I put it in regex101. I think the problem is that we cannot use regex with sourcetype.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...