https://community.splunk.com/t5/Getting-Data-In/Overwrites-to-multiple-indexed-fields-possible-in-one-transforms/m-p/73978#M15134 <P>That was my thought/concern as well. Came into work this morning and added a second transforms call in the props and it did the trick. Thanks!</P> Fri, 28 Sep 2012 15:01:50 GMT Runals 2012-09-28T15:01:50Z https://community.splunk.com/t5/Getting-Data-In/Overwrites-to-multiple-indexed-fields-possible-in-one-transforms/m-p/73976#M15132 <P>We have some syslog feeds coming directly into an indexer. While this will eventually get addressed with forwarders I'd like to overwrite both the source and host indexed fields. <BR /> The forwarded syslogs looke like the following:</P> <PRE><CODE>timestamp Forwarded from IP_address: whatever blah blah blah </CODE></PRE> <P>and we are capturing the forwared from IP address in the following stanza</P> <PRE><CODE>[forwarded] DEST_KEY = MetaData:Host REGEX = Forwarded\sfrom\s([^: ]+): FORMAT = host::$1 </CODE></PRE> <P>Since I'd like to also grab the "whatever" and put it into the source field I'm wondering if I need to do that with a separate stanza in the transforms.conf file or if it can be included in the existing one. If it does require a second stanza in transforms can I call that from a second line in the props.conf stanza? For example</P> <PRE><CODE>props.conf [source blah] TRANSFORMS-1=forwared TRANSFORMS-2=forwared2 transforms.conf [forwarded] --as above-- [forwarded2] DEST_KEY = MetaData:Source REGEX = Forwarded\sfrom\s\d+\.\d+\.\d+\.\d+: (\S+) FORMAT = source::$1 </CODE></PRE> <P>Have I overlooked anything?</P> Fri, 28 Sep 2012 00:34:19 GMT https://community.splunk.com/t5/Getting-Data-In/Overwrites-to-multiple-indexed-fields-possible-in-one-transforms/m-p/73976#M15132 Runals 2012-09-28T00:34:19Z https://community.splunk.com/t5/Getting-Data-In/Overwrites-to-multiple-indexed-fields-possible-in-one-transforms/m-p/73977#M15133 <P>Because of needing to set <CODE>DEST_KEY</CODE>, I think your second approach with two different <CODE>TRANSFORMS-xxx</CODE> rules in props is the proper configuration.</P> Fri, 28 Sep 2012 03:15:25 GMT https://community.splunk.com/t5/Getting-Data-In/Overwrites-to-multiple-indexed-fields-possible-in-one-transforms/m-p/73977#M15133 dwaddle 2012-09-28T03:15:25Z https://community.splunk.com/t5/Getting-Data-In/Overwrites-to-multiple-indexed-fields-possible-in-one-transforms/m-p/73978#M15134 <P>That was my thought/concern as well. Came into work this morning and added a second transforms call in the props and it did the trick. Thanks!</P> Fri, 28 Sep 2012 15:01:50 GMT https://community.splunk.com/t5/Getting-Data-In/Overwrites-to-multiple-indexed-fields-possible-in-one-transforms/m-p/73978#M15134 Runals 2012-09-28T15:01:50Z