Hello!
I was wondering how to use a directory name (segment) as an event tag. For example:
C:\bin\code\python\test_system\scoring\results\16\17055079037\some files log files here or in directory's below this.
The system outputs many hundreds of directories at the 17055079037 level. I don't want to segment on host, source, or sourcetype (as I have manually defined these to cut the console spam). I'd just want the 17055079037 level to be reported as an event attribute, so when I open the error log within Splunk, I can readably see that the log file originated from the 17055079037 directory.
I am guessing this is something to do with segmentation, but I don't know how to configure the inputs.conf for this.
Any suggestions gratefully received.
... View more