topic Re: How use the transform.conf to filter event value and Host in Getting Data In

How use the transform.conf to filter event value and Host

rex_rafa — Tue, 05 Nov 2019 10:34:10 GMT

I have an index receiving events from some hosts, I create a new index and need to send for this new index data that contains the work debug, I create this rule bellow and work.

[ABC]
REGEX = debug
DEST_KEY = _MetaData:Index
FORMAT = debug

The problem is I need to send this event to new index only it has the word debug and specific hosts.
If debug and host=xxx send for index debug if have only debug still sending for the old index.

Re: How use the transform.conf to filter event value and Host

gcusello — Tue, 05 Nov 2019 14:09:16 GMT

Hi rex_rafa,
you could try to use your transformation for the hosts to filter, in other words:
in props.conf:

[host::xxx]
TRANSFORMS-override_index=override_index

In transforms.conf:

[override_index]
REGEX = debug
DEST_KEY = _MetaData:Index
FORMAT = debug

Ciao.
Giuseppe

Re: How use the transform.conf to filter event value and Host

rex_rafa — Wed, 06 Nov 2019 11:55:52 GMT

I use that and work, but I don't know why, but some events sting going for the other index, In 20 events 18 went to correct index and 2 for the wrong index.
I cant understand why it's happening,

Re: How use the transform.conf to filter event value and Host

gcusello — Wed, 06 Nov 2019 12:03:40 GMT

Hi rex_rafa,
check the regex, usually this is the problem.
Then check the hostname.

Ciao.
Giuseppe

Re: How use the transform.conf to filter event value and Host

rex_rafa — Wed, 06 Nov 2019 12:15:02 GMT

Do you know if have any way to see the logs of this transforms.conf?
Because If I get the events and use the https://regexr.com/ to validate the regex, the regex is correct.
The host is correct too, but is strange, because just few events are going to the wrong index.

Re: How use the transform.conf to filter event value and Host

gcusello — Wed, 06 Nov 2019 12:24:52 GMT

Hi rex_rafa,
About the regex check you can do it also in Splunk Search App using the regex command, sometimes, there''s something different.

Anyway, did you checked regex and host values at the same time?
you could use something like this:
| index=wrong_index
| regex "debug"
| table _time host _raw
In this way you can check if events with "debug" have the correct host value or a different one.

Ciao.
Giuseppe