I have created a SEDCMD string that when added to props.conf (and a restart) for the sourcetype will change all new indexed events:
"source to LogSource=
"tag to ContainerImage=
the second / from the end to ,ContainerService=
the first / from the end to ,ContainerID=
It works fine on all of the example data you've posted so far. Splunk automatically recognizes new field= names and sets the values accordingly.
However, the SEDCMD literally changes the event data before it is indexed and the change is permanent (no going back without re-indexing the events). Also, this will not affect any data that has already been indexed, so a separate search like those posted by @somesoni2 would be required for searching old data (or you could re-index the entire data set with the new config).
I can post the string, but I highly recommend that you create a test index, test sourcetype, and test input to test it before you implement it in production.
... View more