Getting Data In

Change source file name while indexing

splunkwar
Explorer

Hi,

I have a source file something like this Samplefile_Infobar_20200331 and I would like to view the source as Samplefile_Infobar_2020-03-31 on Splunk search head (With hyphens between the yyyymmdd). How to do it.

Thanks

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

hi @ splunkwar
try something like this:

| makeresults | eval source="Samplefile_Infobar_20200331.log"
| rex field=source "^(?<prefix>.*)(?<year>\d\d\d\d)(?<month>\d\d)(?<day>\d\d)(?<ext>.*)"
| eval source_final=prefix.year."-".month."-".day.ext
| table source source_final

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @ splunkwar
try something like this:

| makeresults | eval source="Samplefile_Infobar_20200331.log"
| rex field=source "^(?<prefix>.*)(?<year>\d\d\d\d)(?<month>\d\d)(?<day>\d\d)(?<ext>.*)"
| eval source_final=prefix.year."-".month."-".day.ext
| table source source_final

Ciao.
Giuseppe

0 Karma

splunkwar
Explorer

Thanks @gcusello , is there a way to achieve same before indexing ?
thanks in advance.

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @splunkwar,
I cannot test it, so try something like this:
transforms.conf

[source_override]
REGEX = ^(.*)_(\d\d\d\d)(\d\d)(\d\d)(.*)
FORMAT = source::$1_$2-$3-$4$5
SOURCE_KEY=MetaData:Source
DEST_KEY = MetaData:Source

props.conf

[your_sourcetype]
REPORT-source = source_override

Ciao.
Giuseppe

0 Karma

splunkwar
Explorer

Thanks, it works. 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

You're welcome!
See next time!
ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...