Create a new field based on source and apply to all the events from that source at index time

[len_splunker]

I have Splunk looking at specific directories for our Geb Unit test reports where reports for each browsers (Chrome, IE, etc) are in their own folders. Test reports are in XML files and each events are based on testcase tag:

<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="my.own.TestSpec" tests="2" skipped="1" failures="0" errors="0" timestamp="2016-10-17T16:32:09" hostname="pc123" time="0.052">
  <properties/>
  <testcase name="Test one" classname="my.own.TestSpec" time="0.022">
    <skipped/>
  </testcase>
  <testcase name="Another test" classname="my.own.TestSpec" time="0.030"/>
  <system-out><![CDATA[]]></system-out>
  <system-err><![CDATA[Starting ChromeDriver 2.23.409699 (asdf3453fafasdfasfa) on port 1234
Only local connections are allowed.
]]></system-err>
</testsuite>

I would like to be able to create a new field called browser_type based on what test folder the reports came from, i.e. if the report came from IE test folder, then browser_type=IE and add that field to all events of all Geb test reports that will be read from that folder.

Any idea how to go about this?

[TStrauch]

Hi,

look at that probably it can help.

https://answers.splunk.com/answers/6714/extracting-field-from-source-for-indexing.html

regards

[len_splunker]

Thanks @TStrauch! ... I'll check it out... Will let you know if it works for me...