https://community.splunk.com/t5/Splunk-Search/transforms-conf-and-props-conf/m-p/32595#M6814 <P>For <CODE>FORMAT</CODE>, it should reference the number of the capture group in your regular expression (i.e., which set of parentheses are you looking in). You only need WRITE_META for index-time field extractions, which are usually best avoided. Similarly, you can just use <CODE>host</CODE> here in SOURCE_KEY, since it will be a normal field at that point. Last, for your regex - either use <CODE>.*</CODE> to match multiple characters, or just leave it out completely since you're already matching anywhere within the hostname.</P> <P>Try:</P> <PRE><CODE>#transforms.conf [role] SOURCE_KEY=host REGEX=(App|Web|Doc) FORMAT=role::$1 #props.conf: [sourceone] TRANSFORMS-role=role </CODE></PRE> Mon, 28 Sep 2020 09:41:51 GMT southeringtonp 2020-09-28T09:41:51Z https://community.splunk.com/t5/Splunk-Search/transforms-conf-and-props-conf/m-p/32594#M6813 <P>I am trying to extract some values from the Host field. For example, variations of host name being:<BR /> labAppdev03, labWebdev01, labDocDev02. What I am trying to get is App, Web or Doc as a role field out of host name field.</P> <P>What I have so far:</P> <P>transforms.conf:</P> <PRE><CODE>[role] SOURCE_KEY=MetaData:Host REGEX=host::*(App|Web|Doc)* FORMAT=role::app WRITE_META=true </CODE></PRE> <P>Props.conf:</P> <PRE><CODE>[sourceone] TRANSFORMS-role=role </CODE></PRE> Wed, 22 Jun 2011 14:39:31 GMT https://community.splunk.com/t5/Splunk-Search/transforms-conf-and-props-conf/m-p/32594#M6813 fi5033 2011-06-22T14:39:31Z https://community.splunk.com/t5/Splunk-Search/transforms-conf-and-props-conf/m-p/32595#M6814 <P>For <CODE>FORMAT</CODE>, it should reference the number of the capture group in your regular expression (i.e., which set of parentheses are you looking in). You only need WRITE_META for index-time field extractions, which are usually best avoided. Similarly, you can just use <CODE>host</CODE> here in SOURCE_KEY, since it will be a normal field at that point. Last, for your regex - either use <CODE>.*</CODE> to match multiple characters, or just leave it out completely since you're already matching anywhere within the hostname.</P> <P>Try:</P> <PRE><CODE>#transforms.conf [role] SOURCE_KEY=host REGEX=(App|Web|Doc) FORMAT=role::$1 #props.conf: [sourceone] TRANSFORMS-role=role </CODE></PRE> Mon, 28 Sep 2020 09:41:51 GMT https://community.splunk.com/t5/Splunk-Search/transforms-conf-and-props-conf/m-p/32595#M6814 southeringtonp 2020-09-28T09:41:51Z