topic Rename host during indexing in Getting Data In

Rename host during indexing

klischatb — Fri, 03 Dec 2021 08:31:50 GMT

Hello everyone, 🙂

i have the following question.

In my environment i have 3 different UF where a scripted input is working with the original servername to extract some data. Thi sscript is inside one app i deployed the UF, so there is only one inputs.conf working.

What i need to do, is to rename the host name.
I Know that i can do something with the transforms.conf and props.conf, but i dont know how to do this.

example:

Original Hostname	Needed Hostname
slc4E45	EMP
slc4P49	PMP
slc4L47	LMP

Maybe something like...
host = eval(case(host=slc4E45, EMP, host=slc4P49, PMP, host=slc4L47, LMP))
inside the transforms.conf.

Thank you for your help.

Re: Rename host during indexing

gcusello — Fri, 03 Dec 2021 08:41:50 GMT

Hi @klischatb,

as you can read at https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Overridedefaulthostassignments you can override host value based on a regex or a value,

in your case you have to put a props.conf and a transform.conf in your indexer or (when present) on your Heavy Forwarders:

props.conf

[host::slc4E45] TRANSFORMS-slc4E45 = override_host_slc4E45 [host::slc4P49] TRANSFORMS-slc4E45 = override_host_slc4E45 [host::slc4L47] TRANSFORMS-slc4E45 = override_host_slc4E45

transforms.conf

[override_host_slc4E45] REGEX = . FORMAT = EMP DEST_KEY = MetaData:Host [override_host_slc4P49] REGEX = . FORMAT = PMP DEST_KEY = MetaData:Host [override_host_slc4L47] REGEX = . FORMAT = LMP DEST_KEY = MetaData:Host

Remember to restart Splunk after conf files modifying.

Ciao.

Giuseppe

Re: Rename host during indexing

klischatb — Fri, 03 Dec 2021 09:13:33 GMT

Thank you a lot @gcusello. ✔️