topic Re: Change hostname transform in Getting Data In

Change hostname transform

BryanBerry — Tue, 02 Jul 2013 17:45:11 GMT

We have a host where logs are aggregated already. I want to Splunk these logs. The source host for the logs is in the file path. I attempted the below props/transforms as a PoC, but no luck. Can anyone catch what I'm doing wrong?

transforms.conf:

[foobar]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Host
REGEX = ^/opt/splunk/v(ar)
FORMAT = host::bogus$1

props.conf:

[boguslog]
TRANSFORMS-foo=foobar

inputs.conf:

[monitor:///opt/splunk/var/log/splunk/splunkd.log]
sourcetype = boguslog

Also, would this sort of transformation work on a UF or only a HF? I was originally doing this to test for myself, but I can't get it to work on my HF in the first place.

Re: Change hostname transform

BryanBerry — Tue, 02 Jul 2013 17:53:49 GMT

Fixed the transform, thanks to http://splunk-base.splunk.com/answers/24769/host-override.

The ^ in my regex was mucking things up. The MetaData:Source source begins with text "source::". Removing the ^ to permit the "source::" at the start of the value fixed it.

Still haven't gotten it to work on my UF though. Am I correct in understanding that this does not work on the UF?

Re: Change hostname transform

JSapienza — Tue, 02 Jul 2013 19:21:25 GMT

Correct behavior, props and transforms are not processed by a UF .

Re: Change hostname transform

Ayn — Tue, 02 Jul 2013 20:32:04 GMT

Umm, aren't you making this a bit too difficult? Did you have a look at the host_segment configuration directive in inputs.conf?

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

Re: Change hostname transform

BryanBerry — Tue, 02 Jul 2013 21:09:16 GMT

You, sir, are kind of awesome. Using this with the UF actually shaves two weeks off my project by avoiding the heavy forwarder. Thank you!