topic Re: Host override not working. in Getting Data In

Host override not working.

gnagasri — Thu, 23 Apr 2026 14:40:35 GMT

Sample events - working in regex101 : https://regex101.com/r/LuC6ZQ/1

| rex field=_raw "nsssvcip\=(?<host>\d+\.\d+\.\d+\.\d+)" - working in Splunk UI search bar.

Transforms.conf [aaa_sourcetype] DEST_KEY = MetaData:Host FORMAT = host::$1 REGEX = nsssvcip\=(\d+\.\d+\.\d+\.\d+) Props.conf TRANSFORMS-01-set_host = aaa_sourcetype

But when applied the above, it doesnt work for 1st sample event. Kindly suggest.

Re: Host override not working.

gcusello — Thu, 23 Apr 2026 15:07:37 GMT

Hi @gnagasri ,

where did you locate these conf files?

they must be located on the first Heavy Forwarder where data pass through or (if there isn't any Heavy Forwarder) on Indexers.

Ciao.

Giuseppe

Re: Host override not working.

livehybrid — Thu, 23 Apr 2026 15:48:58 GMT

Hi @gnagasri

Your match is at position 5321 in the string however the default limit is 4096 regex lookahead, try setting the LOOKAHEAD value in your transform stanza to a higher value (eg 7000):

LOOKAHEAD = <integer> * NOTE: This option is valid for all index time transforms, such as index-time field creation, or DEST_KEY modifications. * Optional. Specifies how many characters to search into an event. * Default: 4096 * You may want to increase this value if you have event line lengths that exceed 4096 characters (before linebreaking).

For more info check out the transforms docs at https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.4/configuration-file-reference/9.4.0-configuration-file-reference/transforms.conf#:~:text=LOOKAHEAD%20%3D%20%3Cinteger%3E

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Host override not working.

isoutamo — Thu, 23 Apr 2026 18:00:34 GMT

You should try this.
There are lot of other limits like TRUNCATE etc which could also hit, especially in some other issues. I really suggest that you should read those spec files and additionally limits.conf is one useful

Re: Host override not working.

gnagasri — Mon, 27 Apr 2026 05:45:14 GMT

This worked. Thankyou.