Implementing Splunk 7 - Third Edition

Creating a session field from the source

Using our event, let's create another field, session, which appears only to be in the value of the source:

[myapp_session] 
SOURCE_KEY = MetaData:Source 
REGEX = session_(.*?).log 
FORMAT = session::$1 
WRITE_META = True 

Note the SOURCE_KEY attribute. The value of this field can be any existing metadata field or another indexed field that has already been created. See the Attributes with class subsection within the props.conf section for a discussion about the transform execution order. We will discuss these fields in the Modifying metadata fields subsection.