I have a centralized syslog server which I forward all other server logs to. All of those logs are combined per log type such as /var/log/messages, /var/log/secure, etc. I've setup my transforms.conf file to take the hostname out of each line and assign it as the host per log file line. I've associated the transform to the various logs. After restarting the splunk forwarder I'm still not seeing my logs being broken out by host. I'm wondering if it's because of the host value in inputs.conf and if that's overriding the dynamic host value I'm creating via props and transforms. Here is what I have so far:
etc/apps/search/local/transforms.conf
[hostname]
DEST_KEY = MetaData:Host
REGEX = (?:\S+ ){2}(\S+)
FORMAT = host::$1
etc/system/local/props.conf
[source::.../messages]
TRANSFORMS-bg = hostname
SHOULD_LINEMERGE = False
Example from splunk show config inputs
[monitor:///var/log/messages*]
_rcvbuf=1572864
disabled=false
host=[splunk_forwarder_hostname]
index=[index_name]
sourcetype=[source_type]
My concern is the host= attribute associated with every monitor entry. Is this the source of my issues or do I need to be looking somewhere else?
Bert
Hi bpgoodm,
let me understand:
Is it correct?
if this is you situation, the problem is on the location of props.conf and transforms.conf: they must be on Indexers not on Universal Forwarders.
There are only two exceptions to this rule:
Bye.
Giuseppe
Hi Giuseppe,
Ah, thank you. I didn't realize. Your assumptions are correct. I'm setting this stuff up on the Universal Forwarder and the Universal Forwarder is sending the logs to the Indexer. The exceptions you mention don't apply to this situation. Thank you again for the information.
Bert
Hi bpgoodm,
let me understand:
Is it correct?
if this is you situation, the problem is on the location of props.conf and transforms.conf: they must be on Indexers not on Universal Forwarders.
There are only two exceptions to this rule:
Bye.
Giuseppe