Tranformations to set different sourcetypes based on fields in an event

I am trying to change the sourcetype on the events from a dataset based on certain fields in the dataset that is currently being added using a scripted input. This is what I have currently:

props.conf

[source::testservice] TRANSFORMS-changesourcetype = sourcetype-test1info, sourcetype-test2info

transforms.conf

[sourcetype-test1info] DEST_KEY = MetaData:SourceType REGEX = "field1=(?<fieldvalue>[^ ])" FORMAT = sourcetype::test1info CLEAN_KEYS = 0 MV_ADD = 0 [sourcetype-test2info] DEST_KEY = MetaData:SourceType REGEX = "field2=(?<fieldvalue>[^ ])" FORMAT = sourcetype::test2info CLEAN_KEYS = 0 MV_ADD = 0

The files are currently located in etc/apps/appname/local. I dont see this transformation having any effect. The event would look something like: 2011-06-01 20:41:13 PDT timestamp=1306986073 field1=value1 location=testlocation

Any idea what I may be missing?

transforms.conf

asked 02 Jun '11, 08:45

pksudip
3●2
accept rate: 0%

2 Answers:

oldest newest most voted

I believe that your DEST_KEY value isn't valid....keys are case-sensitive and MetaData:Sourcetype is the correct value, not MetaData:SourceType

From: $SPLUNK_HOME/etc/system/README/transforms.conf.spec

*

KEYS:

*

NOTE: Keys are case-sensitive. Use the following keys exactly as they appear.

queue : Specify which queue to send the event to (can be parsingQueue, nullQueue, indexQueue). _raw : The raw text of the event. _done : If set to any string, this represents the last event in a stream. _meta : A space-separated list of metadata for an event. _time : The timestamp of the event, in seconds since 1/1/1970 UTC. MetaData:FinalType : The event type of the event.

MetaData:Host : The host associated with the event. The value must be prefixed by "host::"

_MetaData:Index : The index where the event should be stored.

MetaData:Source : The source associated with the event. The value must be prefixed by "source::"

MetaData:Sourcetype : The sourcetype of the event. The value must be prefixed by "sourcetype::"

link

answered 02 Jun '11, 22:51

cgilbert_splunk
116●2
accept rate: 55%

0	That was the issue, after fixing that I also realized that the regex shouldn't be in double quotes. Thanks for the quick response!! link answered 03 Jun '11, 10:30 pksudip 3●2 accept rate: 0%

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

transforms.conf ×141

Asked: 02 Jun '11, 08:45

Seen: 1,201 times

Last updated: 03 Jun '11, 10:30

Tranformations to set different sourcetypes based on fields in an event

props.conf

transforms.conf

*

KEYS:

*

Follow this question

Splunk Resources

Related questions