Splunk Search

How To Eval Filename As A New Field?

vtsguerrero
Contributor

Shoud it be done in the props.conf stanza at the moment of indexing?
I'm gonna have multiple .txt files indexed and later for a dashboard I need to get these filename to compare each other's values.
Is there a way to create a new field using eval for these filenames?

Thanks in advance!
- Vinicius Guerrero

0 Karma
1 Solution

aweitzman
Motivator

The filename should show up in the source field, right? Why not just use it from there?

View solution in original post

aweitzman
Motivator

The filename should show up in the source field, right? Why not just use it from there?

vtsguerrero
Contributor

But will I be able to table it as a result? Is there any example on how to use it?

0 Karma

aweitzman
Motivator

It's a field like any other field you might have. You can include it in a table ( table source field1 field2... ), you can use it to group your results ( stats sum(field1) by source ), you can create another field by applying a regex to it ( rex field=source "regex-goes-here" ). Anything you can do with a text field you can do with source.

0 Karma

vtsguerrero
Contributor

Thanks @awitzman ! it worked!
I thought it wouldn't work for multiple files, but seems ok without a regex.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...