Splunk Search

how to create sourcetype based on raw field in splunk

disha
Contributor

Hi,
In my case, Splunk is getting data in by tcp port. I configure the TCP port with sourcetype="myagent".
the json format events I am getting looks like:

{"ID":32,"BUILD":"AA123","PNAME":"Cherry","DATE":"Wed Apr 3 01:00:00 2013","UID":"xyz123"}
{"ID":3,"MID":"222-444",,"TS":"Wed May 8 03:15:39 2013","CT":1,"MS":0,"AU":23}

My issue is for ID=3 Splunk getting event data in every 15 sec and for id=32 event data coming once in day. so Eventcount for ID=3 is very huge that ID=32.
When I search ID=32 data it takes so long to display events. I dont know how to search them faster. I am filtering the data on ID=32 as
sourcetype="myagent"|spath |search EID=32
in my search but not much helpful.
I want to ask can I give some different sourcetype name to ID=32 events so that I can search then faster and Splunk dont even look with data ID=3. OR can I attach some unique field which can differentiate between them and search ID=32 data faster? I never used pros.conf or inputs.conf So I am very nerveous to use it.please guide me in right direction to achieve faster retrieval of Events.

Thanks

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

This is probably where you should look;

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Advancedsourcetypeoverrides

The regex should probably be something like below, but you'll have to adjust it according to your data.

REGEX = \"ID\":32, 

Hope this helps,

Kristian

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...