topic Re: Unable to rewrite host meta key at ingestion in Getting Data In

Unable to rewrite host meta key at ingestion

brent_weaver — Sun, 29 Nov 2020 14:49:03 GMT

I have a reg ex tested and working that will extract the host out of these events. My transforms is as follows:

[hostextraction] REGEX = ^.*\d+\s(.*)ASM:.* FORMAT = host::$1 DEST_KEY = MetaData:Host

props:

[myst] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true TIME_PREFIX = ^.{1,16}\b(?:\d{1,3}\.){3}\d{1,3}\b\s TRANSFORMS-whateva = hostextraction

This has no affect on the host metadata key. Any help is much appreciated. I am taking this directly from Splunk Documentation. I am getting this message in _internal

ERROR regexExtractionProcessor - REGEX field must be specified tranform_name=hostextraction

Any help is much appreciated!

Re: Unable to rewrite host meta key at ingestion

isoutamo — Sun, 29 Nov 2020 15:53:31 GMT

Can you provide any sample data where you are trying extract host?

Re: Unable to rewrite host meta key at ingestion

brent_weaver — Sun, 29 Nov 2020 16:51:52 GMT

Sep 20 11:13:18 10.50.3.100 Sep 20 11:13:15 DC1ASM1.dc1.greendotcorp.com ASM:"MONEYPAK_WEBAPP","MONEYPAK_CLASS","Blocked","Attack signature detected","4523972057501654520","207.154.35.240","GET /Content/Images/img_logo01_module02.gif HTTP/1.1\r\nHost: www.moneypak.com\r\nUser-Agent: sam375/1.0[TF268435460801870024000000015076264944] UP.Browser/6.2.3.8 (GUI) MMP/2.0 Profile/MIDP-2.0 Configuration/CLDC-1.1\r\nAccept-Charset: iso-8859-1\r\nAccept-Language: en; q=0.9, es-ve; q=0.9\r\nx-wap-profile: ""http://uaprof1.caohosting.com/UAProfSamsung_R375_TF_V01.xml""\r\nReferer: ../../UseMoneyPak.aspx\r\nCookie: ASP.NET_SessionId=fygzml55xi4i5j45sqnduhy3; __RequestVerificationToken_Lw__=a3NVWCZIIdAJq9jOKEbhic39Vp03TnfuaVRd0mv7yBMYi88KbWiEO1uTpjKuQyybqfSC6JzuMPAA/EPxUpMeeI5hAxDRBepfwT7oeGSTy4xDp+vX7lqDSnJ4C2FI5J6yNRoasA==; TS9d98d7=9f0b4c041f7d935b1147a57259d88de374a21272ed77bfab505b5c7636af3f5e4cdb125288da4b2db1281d8f\r\nAccept: application/octet-stream, application/vnd.oma.drm.content, application/vnd.oma.drm.message, application/vnd.oma.drm.rights+wbxml, application/vnd.oma.drm.rights+xml, a

Re: Unable to rewrite host meta key at ingestion

brent_weaver — Sun, 29 Nov 2020 17:04:18 GMT

See above as I just posted a sample of data.