The TA is overriding my Host Segment in my monitor file. Is there a purpose for this?
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-001
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-002
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-003
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-004
props.conf-###### Global ######
props.conf-[source::...(linux.*|sample.*.linux)]
props.conf:TRANSFORMS-force_host_for_linux_eventgen = force_host_for_linux_eventgen
It appears you've run into some configuration used specifically by eventgen. Eventgen is used to demo or get a sense of an addon without having to collect real data.
Specifically, it looks like you happen to be collecting a source that follows the file name pattern (linux.*|sample.*.linux)
.
This could be as simple as making sure your filename does not match that pattern.
Alternatively, you could add a props.conf
to the local
folder of the TA that unsets that configuration. Maybe something like:
[source::...(linux.*|sample.*.linux)]
TRANSFORMS-force_host_for_linux_eventgen =
I haven't tested but in my mind that should unset that attribute and provide safety with upgrades of the TA.
Feel free to share the name of the file if it helps in the discussion.
Ran into this issue with data coming from another Splunk environment. This answer fixed the issue.
I deleted that part of the config file as a resolution.
But remember that it will return every time you upgrade/update the app since it's part of the default
folder's configuration (right?).
Unsetting it in the local
will persist through upgrades.