https://community.splunk.com/t5/Splunk-Enterprise/How-To-Append-Nix-Variable-to-MetaData-Source/m-p/523955#M3726 <P>Hi,</P><P>How to properly append the server's hostname, i.e. $HOSTNAME to the source? This was my failed attempt:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">#transforms.conf [append-hf-hostname-to-src] SOURCE_KEY = source REGEX = (.*) FORMAT = source::$1:$HOSTNAME DEST_KEY = MetaData:Source #props.conf [my:cute:sourcetype] TRANSFORMS-newsrc=append-hf-hostname-to-src</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>Thanks in advance.</P> Fri, 09 Oct 2020 16:35:17 GMT morethanyell 2020-10-09T16:35:17Z https://community.splunk.com/t5/Splunk-Enterprise/How-To-Append-Nix-Variable-to-MetaData-Source/m-p/523955#M3726 <P>Hi,</P><P>How to properly append the server's hostname, i.e. $HOSTNAME to the source? This was my failed attempt:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">#transforms.conf [append-hf-hostname-to-src] SOURCE_KEY = source REGEX = (.*) FORMAT = source::$1:$HOSTNAME DEST_KEY = MetaData:Source #props.conf [my:cute:sourcetype] TRANSFORMS-newsrc=append-hf-hostname-to-src</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>Thanks in advance.</P> Fri, 09 Oct 2020 16:35:17 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-To-Append-Nix-Variable-to-MetaData-Source/m-p/523955#M3726 morethanyell 2020-10-09T16:35:17Z https://community.splunk.com/t5/Splunk-Enterprise/How-To-Append-Nix-Variable-to-MetaData-Source/m-p/523956#M3727 <P>From what I understand, the only environment variable you can rely on in config file is $SPLUNK_HOME.</P> Fri, 09 Oct 2020 17:12:13 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-To-Append-Nix-Variable-to-MetaData-Source/m-p/523956#M3727 richgalloway 2020-10-09T17:12:13Z