The TA is overriding my Host Segment in my monitor file. Is there a purpose for this?
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-001 Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-002 Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-003 Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-004 props.conf-###### Global ###### props.conf-[source::...(linux.*|sample.*.linux)] props.conf:TRANSFORMS-force_host_for_linux_eventgen = force_host_for_linux_eventgen
It appears you've run into some configuration used specifically by eventgen. Eventgen is used to demo or get a sense of an addon without having to collect real data.
Specifically, it looks like you happen to be collecting a source that follows the file name pattern
This could be as simple as making sure your filename does not match that pattern.
Alternatively, you could add a
props.conf to the
local folder of the TA that unsets that configuration. Maybe something like:
[source::...(linux.*|sample.*.linux)] TRANSFORMS-force_host_for_linux_eventgen =
I haven't tested but in my mind that should unset that attribute and provide safety with upgrades of the TA.
Feel free to share the name of the file if it helps in the discussion.
But remember that it will return every time you upgrade/update the app since it's part of the
default folder's configuration (right?).
Unsetting it in the
local will persist through upgrades.