topic Re: Why does SOURCE_KEY=MetaData:Host not work for REPORT stanzas? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Why-does-SOURCE-KEY-MetaData-Host-not-work-for-REPORT-stanzas/m-p/46781#M11178 <P>It seems that <CODE>MetaData:Host</CODE> is only available at index time, for index-time transforms.</P> <P>Use <CODE>SOURCE_KEY = host</CODE> when using the transform at search time.</P> Fri, 18 Feb 2011 02:59:03 GMT Jason 2011-02-18T02:59:03Z Why does SOURCE_KEY=MetaData:Host not work for REPORT stanzas? https://community.splunk.com/t5/Splunk-Search/Why-does-SOURCE-KEY-MetaData-Host-not-work-for-REPORT-stanzas/m-p/46780#M11177 <P>I am trying to extract data from the Host field at search time, using a <CODE>REPORT-</CODE> in props.conf.</P> <P>The extraction works when I use <CODE>SOURCE_KEY = ComputerName</CODE>, a field in the data that contains the host. But, this is only available in <CODE>WinEventLog</CODE> data, and I want it to apply to all hosts regardless of type of data.</P> <P>I have tried <CODE>SOURCE_KEY = MetaData:Host</CODE>, but it does not work. What gives?</P> Fri, 18 Feb 2011 02:57:56 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-SOURCE-KEY-MetaData-Host-not-work-for-REPORT-stanzas/m-p/46780#M11177 Jason 2011-02-18T02:57:56Z Re: Why does SOURCE_KEY=MetaData:Host not work for REPORT stanzas? https://community.splunk.com/t5/Splunk-Search/Why-does-SOURCE-KEY-MetaData-Host-not-work-for-REPORT-stanzas/m-p/46781#M11178 <P>It seems that <CODE>MetaData:Host</CODE> is only available at index time, for index-time transforms.</P> <P>Use <CODE>SOURCE_KEY = host</CODE> when using the transform at search time.</P> Fri, 18 Feb 2011 02:59:03 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-SOURCE-KEY-MetaData-Host-not-work-for-REPORT-stanzas/m-p/46781#M11178 Jason 2011-02-18T02:59:03Z