In the Splunk Add-on for Unix and Linux, can you help me with a Splunk_TA_nix Issue with transform?

[bgagliardi1]

The TA is overriding my Host Segment in my monitor file. Is there a purpose for this?

Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-001
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-002
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-003
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-004

props.conf-###### Global ######
props.conf-[source::...(linux.*|sample.*.linux)]
props.conf:TRANSFORMS-force_host_for_linux_eventgen = force_host_for_linux_eventgen

[sloshburch]

It appears you've run into some configuration used specifically by eventgen. Eventgen is used to demo or get a sense of an addon without having to collect real data.

Specifically, it looks like you happen to be collecting a source that follows the file name pattern (linux.*|sample.*.linux).

This could be as simple as making sure your filename does not match that pattern.
Alternatively, you could add a props.conf to the local folder of the TA that unsets that configuration. Maybe something like:

[source::...(linux.*|sample.*.linux)]
TRANSFORMS-force_host_for_linux_eventgen = 

I haven't tested but in my mind that should unset that attribute and provide safety with upgrades of the TA.

Feel free to share the name of the file if it helps in the discussion.

[raytrotter_exp]

Ran into this issue with data coming from another Splunk environment. This answer fixed the issue.

[bgagliardi1]

I deleted that part of the config file as a resolution.

[sloshburch]

But remember that it will return every time you upgrade/update the app since it's part of the default folder's configuration (right?).

Unsetting it in the local will persist through upgrades.