topic How replace host using a field in Splunk Search

How replace host using a field

tamakg — Tue, 29 Sep 2020 15:07:49 GMT

Hi,

I'm trying to replace the host value using a field in the data. I tried to find any previous similar solution but it's not working.

A sample of the data is here:

'##REC##;WWWDBDW;3221912927;wwwdbdw1;x52wwwdb01.domain.com;11.2.0.4.0;Linux x86 64-bit;00008481;25-Aug-16 12:00:01;25.40;0.00;0.00;0.00;964278.51;0.00;2.55;4.06;1.59'

props.conf
[www_general_stats]
TRANSFORMS-host = www_host

transforms.conf
[www_host]
SOURCE_KEY = _raw
DEST_KEY = Metadata::Host
FORMAT = host::$1
REGEX = ^(?:[^;\n]*;){4}(?P[^;]+)

Can anyone help me here, please?

Re: How replace host using a field

rjthibod — Tue, 01 Aug 2017 19:49:57 GMT

You don't need the ?P part in your regex.

Use this instead: REGEX = ^(?:[^;\n]*;){4}([^;]+)

Re: How replace host using a field

cpetterborg — Tue, 01 Aug 2017 22:15:57 GMT

I don't know what is "not working" (could be that it isn't finding the host properly and thus assigning something else in the field, or not assigning the host at all - you didn't really specify that). I do see two problems, one which was answered by rjthibod already and the other is the DEST_KEY. One colon instead of two:

DEST_KEY = MetaData:Host

Re: How replace host using a field

tamakg — Tue, 01 Aug 2017 22:27:27 GMT

The issue seems to be the upper case D of MetaData. Worked fine!

Thank you!

Re: How replace host using a field

tamakg — Tue, 01 Aug 2017 22:31:12 GMT

AND the single colon...