All Apps and Add-ons

In the Splunk Add-on for Unix and Linux, can you help me with a Splunk_TA_nix Issue with transform?

Path Finder

The TA is overriding my Host Segment in my monitor file. Is there a purpose for this?

Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-001
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-002
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-003
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-004

props.conf-###### Global ######
props.conf-[source::...(linux.*|sample.*.linux)]
props.conf:TRANSFORMS-force_host_for_linux_eventgen = force_host_for_linux_eventgen
0 Karma

Ultra Champion

It appears you've run into some configuration used specifically by eventgen. Eventgen is used to demo or get a sense of an addon without having to collect real data.

Specifically, it looks like you happen to be collecting a source that follows the file name pattern (linux.*|sample.*.linux).

This could be as simple as making sure your filename does not match that pattern.
Alternatively, you could add a props.conf to the local folder of the TA that unsets that configuration. Maybe something like:

[source::...(linux.*|sample.*.linux)]
TRANSFORMS-force_host_for_linux_eventgen = 

I haven't tested but in my mind that should unset that attribute and provide safety with upgrades of the TA.

Feel free to share the name of the file if it helps in the discussion.

Ran into this issue with data coming from another Splunk environment. This answer fixed the issue.

0 Karma

Path Finder

I deleted that part of the config file as a resolution.

0 Karma

Ultra Champion

But remember that it will return every time you upgrade/update the app since it's part of the default folder's configuration (right?).

Unsetting it in the local will persist through upgrades.

0 Karma