topic Re: How do I route based on host and source type? in Getting Data In

How do I route based on host and source type?

lukessi — Mon, 24 Sep 2018 14:33:16 GMT

Hi,

I am routing traffic to a 3rd party. I have done some of this based on a host and others based on the source type.

But I now need to route based on a host and a sourcetype and I can't work out how to do it?

Any tips of where to look?

Re: How do I route based on host and source type?

FrankVl — Mon, 24 Sep 2018 15:42:17 GMT

I think you could do something along these lines, triggering the transforms based on sourcetype, but inside the transforms config filter by host using the REGEX.

props.conf:

[yoursourcetype]
TRANSFORMS-setrouting = your-routing

transforms.conf

[your-routing]
SOURCE_KEY = MetaData:Host
REGEX = (host1|host2|...|hostn)
DEST_KEY = _TCP_ROUTING
FORMAT = your-outputgroup

Re: How do I route based on host and source type?

lukessi — Mon, 24 Sep 2018 15:50:04 GMT

Cheers mate I came to that solution too. Just double checking if there was another way.

Re: How do I route based on host and source type?

krithikar — Fri, 21 Apr 2023 09:50:01 GMT

What if we have multiple hosts , say 500 and above can we mark and * to pick up all the host name .

REGEX = (host*)

If my host name starts with ABCD and if i say ABCD* will this work ?. Or say my events have these hosts under a field called computername

REGEX = (?ms)(ComputerName=ABCD*.domain.com)