Getting Data In

How can I set the sourcetype to a value from the input stream?

ddrillic
Ultra Champion

I have a name value data stream which contains the following - "msg_sourcetype": "syslog-test". How can I set the sourcetype to be - syslog-test?

The following works - | rex "msg_sourcetype\": \"(?<one>[a-zA-Z]*)" ignoring the dash for now.

So, I guess in transforms.conf, I can have something like following, but I'm not sure about the one field...

[<our>_sourcetype]
REGEX = "msg_sourcetype\": \"(?<one>[a-zA-Z]*)" 
FORMAT = sourcetype::$1
DEST_KEY = MetaData:Sourcetype

The following is a big help - Set host values based on event data

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

The following should work. Note that you do not give the field a name in the regular expression. Also, your regular expression did not give the dash as a possible character, so it would not be able to extract syslog-test. Are there any other characters that you should also include?

 [old_sourcetype]
 REGEX = \"msg_sourcetype\": \"([a-zA-Z-]*)\"
 FORMAT = sourcetype::$1
 DEST_KEY = MetaData:Sourcetype

View solution in original post

0 Karma

lguinn2
Legend

The following should work. Note that you do not give the field a name in the regular expression. Also, your regular expression did not give the dash as a possible character, so it would not be able to extract syslog-test. Are there any other characters that you should also include?

 [old_sourcetype]
 REGEX = \"msg_sourcetype\": \"([a-zA-Z-]*)\"
 FORMAT = sourcetype::$1
 DEST_KEY = MetaData:Sourcetype
0 Karma

ddrillic
Ultra Champion

Perfect - thank you!!!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...