Getting Data In

How can I set the sourcetype to a value from the input stream?

ddrillic
Ultra Champion

I have a name value data stream which contains the following - "msg_sourcetype": "syslog-test". How can I set the sourcetype to be - syslog-test?

The following works - | rex "msg_sourcetype\": \"(?<one>[a-zA-Z]*)" ignoring the dash for now.

So, I guess in transforms.conf, I can have something like following, but I'm not sure about the one field...

[<our>_sourcetype]
REGEX = "msg_sourcetype\": \"(?<one>[a-zA-Z]*)" 
FORMAT = sourcetype::$1
DEST_KEY = MetaData:Sourcetype

The following is a big help - Set host values based on event data

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

The following should work. Note that you do not give the field a name in the regular expression. Also, your regular expression did not give the dash as a possible character, so it would not be able to extract syslog-test. Are there any other characters that you should also include?

 [old_sourcetype]
 REGEX = \"msg_sourcetype\": \"([a-zA-Z-]*)\"
 FORMAT = sourcetype::$1
 DEST_KEY = MetaData:Sourcetype

View solution in original post

0 Karma

lguinn2
Legend

The following should work. Note that you do not give the field a name in the regular expression. Also, your regular expression did not give the dash as a possible character, so it would not be able to extract syslog-test. Are there any other characters that you should also include?

 [old_sourcetype]
 REGEX = \"msg_sourcetype\": \"([a-zA-Z-]*)\"
 FORMAT = sourcetype::$1
 DEST_KEY = MetaData:Sourcetype
0 Karma

ddrillic
Ultra Champion

Perfect - thank you!!!

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...