How to use conditional regex in transforms.conf to capture the hostname based on field criteria?

arizviherjavec — Fri, 02 Mar 2018 16:18:55 GMT

Here's a sample Log:

Mar  2 09:27:24 Blue_Firewall 1,2018/03/02 09:27:24,00546543517,THREAT,url,1,2018/03/02 09:27:18,102.12.40.148,11.0.54.3,32.0.01.34,121.120.54.3,DG_OUT_Internet-WebBrowse_Allow,arkansas\joeblo,,ssl,vsys1,Genius,Untrust_L3,ethernet1/2.40,ethernet1/1,Fwd-to-Some-Zone,2018/03/02 09:27:18,1662,1,51096,443,44426,443,0x40b000,tcp,alert,"amers2.apps.cp.thomsonreuters.com/",(9999),business-and-economy,informational,client-to-server,757565465,0x8000000000000000,10.0.0.0-10.255.255.255,United States,0,,0,,,0,,,,,,,,0,13,0,0,0,,Firewall-Name,,,,,0,,0,,N/A,unknown,AppThreat-0-0,0x0

So here's what I want,

If "Red-Firewall" or "Green-Firewall" exists near the bottom of the log (where it says "Firewall-Name"), I want the hostname to be Red-... or Green-..., however, if there is any OTHER name there, or that field is empty, I want it to use whatever is at "Blue_Firewall" location as the hostname.

So far, when there was only 2, I could easily use

REGEX=\,(Red-Firewall|Green-Firewall)\,
FORMAT=host::$1
DEST_KEY=MetaData:Host

Now, I cannot.

Any ideas?

Re: How to use conditional regex in transforms.conf to capture the hostname based on field criteria?

FrankVl — Mon, 05 Mar 2018 10:08:30 GMT

If you use the "blue_firewall" hostname as the default option and then overwrite it with that config you already had, that should work, right? If the regex for red/green doesn't match, it will keep the current hostname value.

topic How to use conditional regex in transforms.conf to capture the hostname based on field criteria? in Splunk Search

How to use conditional regex in transforms.conf to capture the hostname based on field criteria?

Re: How to use conditional regex in transforms.conf to capture the hostname based on field criteria?