topic Override host and sourcetype value with event data in Splunk Enterprise

Override host and sourcetype value with event data

JohnSmith123 — Mon, 12 May 2025 04:36:16 GMT

Hello everyone. I'm trying to set host and sourcetype values with event data. The result is that, the sourcetype is overridden as expected, while the host value is NOT.

By applying the following tranforms.conf and props.conf, I expect that

The sourcetype is overridden from default:log to mysp(which works as expected).
Then, for events with sourcetype mysp, override the host value with my event data using regex extraction(which didn't work).

It's making me confused. Wondering why it didn't work out for host field. Hopefully someone would kindly help me out here. Thanks.

transforms.conf

[sourcetype_transform]
SOURCE_KEY = _raw
REGEX = <my_regex>
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::mysp

[host_transform]
REGEX = <my_regex>
FORMAT = host::$1
DEST_KEY = MetaData:Host

props.conf

[default:log]
TRANSFORMS-force_sourcetype = sourcetype_transform

[mysp]
TRANSFORMS-force_host = host_transform

Re: Override host and sourcetype value with event data

kiran_panchavat — Mon, 12 May 2025 05:01:13 GMT

@JohnSmith123

Ensure that your regex in host_transform correctly matches the part of the event data you want to extract as the host. You can test your regex separately to confirm it captures the desired value.

please provide:

The actual REGEX used in host_transform and sourcetype_transform.
A sample of the raw event data (_raw).
Details about where the configurations are deployed (e.g., heavy forwarder).

Re: Override host and sourcetype value with event data

livehybrid — Mon, 12 May 2025 06:27:04 GMT

Hi @JohnSmith123

I dont think you get two-bites of the props.conf cherry when changing a sourcetype name, instead you need to apply your host_transform to the "default:log" sourcetype rather than the new sourcetype name.

Try the following:

== props.conf == [default:log] TRANSFORMS-force_sourcetype = sourcetype_transform TRANSFORMS-force_host = host_transform == transforms.conf == [sourcetype_transform] SOURCE_KEY = _raw REGEX = <my_regex> DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::mysp [host_transform] REGEX = <my_regex> FORMAT = host::$1 DEST_KEY = MetaData:Host

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Override host and sourcetype value with event data

PickleRick — Mon, 12 May 2025 06:37:38 GMT

If I understand you correctly, you're rewriting sourcetype to mysp and then expect Splunk to apply transforms define for that sourcetype to the events further down the ingestion pipeline. It doesn't work that way (but it's a common expectation, I myself thought it did a few years ago).

Splunk decides at the beginning of the pipeline which settings apply to sourcetype/source/host triple and subsequent rewrites to those fields do not change it - the event goes through ingestion pipeline using the originally decided transforms.

The only way to "switch" to another sourcetype is to use CLONE_SOURCETYPE (but then you have to handle the original copy of the event as well).

Re: Override host and sourcetype value with event data

JohnSmith123 — Mon, 12 May 2025 11:45:05 GMT

Yes, this is exactly what I expected. Thank you for confirming the way it works.

Re: Override host and sourcetype value with event data

JohnSmith123 — Mon, 12 May 2025 11:45:38 GMT

Hello @livehybrid . It works. Thanks a lot