Hello, I have a chart that show event counts split by source name. For our analysis, it is very important that we see the source names. Because of the long path, the important part is .....
e.g.
/opt/applocal/fs/dir/Log.log
shows as
/opt/applocal......log
Is there anything from Splunk Web I can do to improve the chart?
The replace
search command is really helpful here too. It's a little less flexible than the rex
approach, but it can also be much simpler to use. (And there's no reason why you can't do both for different types of source names.)
Here is an example I grabbed from one of my saved searches with source renaming:
... | replace "*var*log*splunk*metrics.log*" with "splunk/metrics.log" "/stage/logs/*" with "/stage/logs/LOGFILE" "*var*log*splunk*splunkd.log*" with "splunk/splunkd.log" "/common/log/prefix/*.log" with "*.log" in source | ...
You could use the rex command to rewrite the source field.
... | rex field=source "/(?<sourcefile>[^/]+?)$" | timechart count by sourcefile
That will transform a source that looks like "/opt/applocal/fs/dir/Log.log" to a field called sourcefile like "Log.log"