https://community.splunk.com/t5/Getting-Data-In/WMI-route-to-nullQueue-based-on-host-Is-it-possible/m-p/68522#M13858 <P>When retrieving EventLogs through WMI, the host value is assigned by a system/detault/props.conf config:</P> <PRE><CODE>[wmi] TRANSFORMS-FIELDS = wmi-host,... </CODE></PRE> <P>Can I specify a "local" props where I use the [host::] stanza to apply some further TRANSFORMS? </P> <P>I am getting troubles as it seems like when my stanza is executed, the events' host field is still the name of the HWF, i.e. my stanza's transforms are executed BEFORE [wmi-host].</P> <P>My config stanza is like this:</P> <PRE><CODE>[host::servername] TRANSFORMS-IAS = sentAllToNullQueue, KeepIAS </CODE></PRE> <P>p.s. if I modify the stanza to [WMI:WinEventLog:System] my configs work fine, except that they are applied to all the hosts, not just the one I need...</P> Mon, 24 Sep 2012 15:38:38 GMT Paolo_Prigione 2012-09-24T15:38:38Z https://community.splunk.com/t5/Getting-Data-In/WMI-route-to-nullQueue-based-on-host-Is-it-possible/m-p/68522#M13858 <P>When retrieving EventLogs through WMI, the host value is assigned by a system/detault/props.conf config:</P> <PRE><CODE>[wmi] TRANSFORMS-FIELDS = wmi-host,... </CODE></PRE> <P>Can I specify a "local" props where I use the [host::] stanza to apply some further TRANSFORMS? </P> <P>I am getting troubles as it seems like when my stanza is executed, the events' host field is still the name of the HWF, i.e. my stanza's transforms are executed BEFORE [wmi-host].</P> <P>My config stanza is like this:</P> <PRE><CODE>[host::servername] TRANSFORMS-IAS = sentAllToNullQueue, KeepIAS </CODE></PRE> <P>p.s. if I modify the stanza to [WMI:WinEventLog:System] my configs work fine, except that they are applied to all the hosts, not just the one I need...</P> Mon, 24 Sep 2012 15:38:38 GMT https://community.splunk.com/t5/Getting-Data-In/WMI-route-to-nullQueue-based-on-host-Is-it-possible/m-p/68522#M13858 Paolo_Prigione 2012-09-24T15:38:38Z https://community.splunk.com/t5/Getting-Data-In/WMI-route-to-nullQueue-based-on-host-Is-it-possible/m-p/68523#M13859 <P>No, it is not possible. </P> <P>TRANSFORMS are executed AFTER props.conf stanza evaluations. So, if I use transforms to assign a new host or sourcetype, the related [host::....] and [surcetype] stanzas are NOT applied. </P> <P>The only way to go is to replicate transforms to apply any necessary modifications, such as routing to nullQueue, assign to different index, and so on. </P> Mon, 19 Nov 2012 13:57:27 GMT https://community.splunk.com/t5/Getting-Data-In/WMI-route-to-nullQueue-based-on-host-Is-it-possible/m-p/68523#M13859 Paolo_Prigione 2012-11-19T13:57:27Z