topic Re: transforms.conf set hostname to current host in Getting Data In

transforms.conf set hostname to current host

arjunpkishore5 — Mon, 29 Jun 2020 22:42:05 GMT

Hi,

Is there a way to use environment variables within transforms.conf. I am trying to override the hostname to the hostname of the forwarder which receives it.

I'm using the following. However, this doesn't seem to be working. The conf files are distributed from a deployment server, so I don't want to hard-code the host names

[hostoverride] DEST_KEY = MetaData:Host REGEX = . FORMAT = host::$HOSTNAME

Re: transforms.conf set hostname to current host

richgalloway — Tue, 30 Jun 2020 00:45:19 GMT

That you're using a deployment server tells me the transforms.conf file is on a universal forwarder. If so, it's not working because UFs do not perform transforms. That's done by indexers and HFs.

Re: transforms.conf set hostname to current host

msimko_splunk — Tue, 30 Jun 2020 00:47:20 GMT

I don't have good news for you, but I do have some questions.
Sadly, I suspect what you are trying to do is outside the scope of transforms, especially when using a deployment server.

1. Is this a heavyweight forwarder, or a universal forwarder?

1a. If a Heavyweight, then how is the data being sent to it? From another forwarder?
1a1. If from a UF, then I suspect you'll have to write different apps, one for each HF. This is far from ideal, but will get the job done. Hopefully you don't have too many HFs to have to create for these rules.
1a2. If from a syslog or networking device you can just use the default hostname and the HF's hostname will be applied.

1b. If this is a universal forwarder, then is the data coming from another UF, or something like a syslog device?
1b1. If from another UF you have issues coming. I don't think you can make this work.
1b2. If from a syslog or network device, then use the default hostname, which will default to the forwarder.

Maybe someone else will have a better answer for you.

Re: transforms.conf set hostname to current host

arjunpkishore5 — Tue, 30 Jun 2020 01:09:38 GMT

Actually, This resides on a heavy forwarder.

Re: transforms.conf set hostname to current host

arjunpkishore5 — Tue, 30 Jun 2020 01:11:28 GMT

The source is HEC. The forwarders are on a load balanced url for HEC inputs. I'm trying to override the host from the LB url to the forwarder that receives it.