title: How to change behavior on Splunk imports from Azure logs using MS Splunk Add-on
body: <p>I have some webjobs set up and deployed to Azure, and System.Diagnostics.Trace output is automatically uploaded to (blob db)/(service name)/(year)/(month)/(day)/(hour)/(instance-id)-(pid).applicationLog.csv.</p>
  
  <p>I have the MS Splunk add-on reading these blobs, as per here:
          <a href="http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureinputs5" rel="nofollow noreferrer">http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureinputs5</a></p>
  
  <p>The import works fine, so now I am looking for a way to change the default behavior in a few ways:</p>
  
  <ol>
  <li>Splunk reports the source of the data as the full blob name, eg "MyService/2017/07/15/1234-5678.applicationLog.csv"</li>
  </ol>
  
  <p>Desired:  Splunk reports the source of the data just the service name, eg "MyService". This will make searching on source easier</p>
  
  <ol start="2">
  <li>Splunk reports the host for the data as the host Splunk is installed on</li>
  </ol>
  
  <p>Desired:  Splunk reports the host as (instance-id), which is in the imported file's name and inside each row in the file.</p>
  
  <ol start="3">
  <li>(This is the most important one!)  Splunk reports the Time of the data as the time it was imported to Splunk via the add-in.</li>
  </ol>
  
  <p>Desired: Splunk reports the Time as given by when the log was made; this value is in the payload of the .csv file</p>
  
  <p>Any thoughts here?</p>