Splunk DB Connect: How to override the default host field?

[splunkrocks2014]

I have a "host" field already available from a SQL query. What is the value that needs to be put in "Set the host with this value" from Splunk DB Connect Input Service settings so that it can override the default host?

Thanks.

[jcoates_splunk]

I thought we added that in version 2.3 or 2.4... but I know it's there in v3. http://blogs.splunk.com/2017/02/20/splunk-db-connect-3-released/

[muebel]

Hi splunkrocks2014, I don't think you can configure dbx 2.x to have a host value given in the data, but I expect you could use props and transforms to do this. i.e. something like:

 [mySourcetype]
 TRANSFORMS-setHost=host_override

 [host_override]
 REGEX = (regex to extract host value from event)
 DEST_KEY = MetaData:Host
 FORMAT = host::$1

Please let me know if this answers your question! 😄

[bmacias84]

I've had the same problem with DB Connect 2. The UI doesnt give you the ability to change the host key for DBX inputs. There are two methods:
1) Edit the inputs.conf directly and edit the stanza with host=yourhost (make sure to stop the service)
2) If the host value is with in the data you can use a transform to extract the host per event and replace host value. Make sure to add it to your props.conf for that source or sourcetype.