https://community.splunk.com/t5/Dashboards-Visualizations/Custom-Log-in-Splunk/m-p/53732#M43882 <P>You will have to make a dive into the world of index-time transforms.</P> <P>Firstly, you have set the sourcetype to 'syslog', which it clearly isn't. This has implications, because Splunk will try to extract host information from each event. This will fail, since the events are not properly syslog-formatted. Change the sourcetype to 'my_ping_log' or something unique. Also, if possible, let the script add a date/timestamp to each event as well. </P> <P>You should look at the following docs for rewriting the host value prior to indexing the events. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Overridedefaulthostassignments" target="_blank">http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Overridedefaulthostassignments</A></P> <P>I guess that your files should look something like;</P> <P>props.conf</P> <PRE><CODE>[my_ping_log] TRANSFORMS-set_host = ping_script_host </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[ping_script_host] REGEX = ^(\S+)\s+.* DEST_KEY = MetaData:Host FORMAT = host::$1 </CODE></PRE> <P>Please note that the REGEX works for the current event format, i.e. without a timestamp.</P> <P>Hope this helps,</P> <P>Kristian</P> Mon, 28 Sep 2020 12:54:31 GMT kristian_kolb 2020-09-28T12:54:31Z https://community.splunk.com/t5/Dashboards-Visualizations/Custom-Log-in-Splunk/m-p/53731#M43881 <P>Hy,</P> <P>i write a batch script that pings IP-Adresses.<BR /> The Results are in a .log file looks like:<BR /> Switch1 Online<BR /> Switch2 Online</P> <P>When i add the .log as syslog in Splunk i see this entry:<BR /> 1 » 12/4/12<BR /> 2:07:44.000 PM </P> <P>Switch2 Online</P> <PRE><CODE>host=Splunkserver Options| sourcetype=syslog Options| source=C:\test.log Options </CODE></PRE> <P>2 » 12/4/12<BR /> 2:07:44.000 PM </P> <P>Switch1 Online</P> <PRE><CODE>host=Splunkserver Options| sourcetype=syslog Options| source=C:\test.log Options </CODE></PRE> <P>How can i change the Entry for "host"? The i see host=Switch1 or Switch2, how must look my log file? And How can i add the Option "Status=Online", "Status=Offline" that i can create a search command like this:<BR /> source="C:\test.log" host="*" | stats count count(eval(Type="Online")) as On count(eval(Type="Offline")) as Off by host</P> <P>When i try this, i see only a count at "counter" nothing at Off and On.</P> <P>Any idea or tips for me?<BR /> thx</P> Tue, 04 Dec 2012 13:16:01 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Custom-Log-in-Splunk/m-p/53731#M43881 Rhuen 2012-12-04T13:16:01Z https://community.splunk.com/t5/Dashboards-Visualizations/Custom-Log-in-Splunk/m-p/53732#M43882 <P>You will have to make a dive into the world of index-time transforms.</P> <P>Firstly, you have set the sourcetype to 'syslog', which it clearly isn't. This has implications, because Splunk will try to extract host information from each event. This will fail, since the events are not properly syslog-formatted. Change the sourcetype to 'my_ping_log' or something unique. Also, if possible, let the script add a date/timestamp to each event as well. </P> <P>You should look at the following docs for rewriting the host value prior to indexing the events. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Overridedefaulthostassignments" target="_blank">http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Overridedefaulthostassignments</A></P> <P>I guess that your files should look something like;</P> <P>props.conf</P> <PRE><CODE>[my_ping_log] TRANSFORMS-set_host = ping_script_host </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[ping_script_host] REGEX = ^(\S+)\s+.* DEST_KEY = MetaData:Host FORMAT = host::$1 </CODE></PRE> <P>Please note that the REGEX works for the current event format, i.e. without a timestamp.</P> <P>Hope this helps,</P> <P>Kristian</P> Mon, 28 Sep 2020 12:54:31 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Custom-Log-in-Splunk/m-p/53732#M43882 kristian_kolb 2020-09-28T12:54:31Z