Implementing Splunk 7 - Third Edition

Creating a loglevel field

The format of a typical stanza in transforms.conf looks like this:

[myapp_loglevel] 
REGEX = s([A-Z]+)s 
FORMAT = loglevel::$1 
WRITE_META = True 

This will add to our events the field loglevel=DEBUG. This is a good idea if the values of loglevel are common words outside of this location, for instance ERROR.

Walking through this stanza, we have the following:

• [myapp_loglevel]: The stanza can be any unique value, but it is in your best interest to make the name meaningful. This is the name referenced in props.conf.
• REGEX = s([A-Z]+)s: This is the pattern to test against each event that is handed to us. If this pattern does not match, this transform will not be applied.
• FORMAT = loglevel::$1: Create the loglevel. Under ...