We have 100 hosts and for all these hosts we want to append a keyword to the host name. for example, hostnames are TEST1, TEST2 and TEST3 and we want to add a keyword called APP, so the final host's name will be like APPTEST1, APPTEST2 and APPTEST3. Can we do this at UF level?
Note- we don't want to do this based on source and source type at HF level because of the default source and source types.
UF does only simple ingestion and generally does not modify the events. You can set your metadata to a static value but not calculate it dynamicaly.
Your non-splunk solution would be to use a third-party provisioning software (like ansible, chef or puppet) to prepare your UF configs dynamically so that the host setting at the UF level or even a single input is set to this dynamic value.
Alternatively, you can do an index-time rewrite of your metadata with a transform similar to what @gcusello presented, just tied to a group of hosts with a matching pattern - see https://docs.splunk.com/Documentation/Splunk/Latest/Admin/Propsconf#GLOBAL_SETTINGS
you have two choices:
There's also a workaround: you could create a calculated field that override the host vale at search time, not at index time.
the easiest solution is the override the host value when you encounter one of the hosts that you don't want:
on props.conf (of Heavy Forwarder:
[host::TEST1] TRANSFORMS-override_host = override_host [host::TEST2] TRANSFORMS-override_host = override_host [host::TEST3] TRANSFORMS-override_host = override_host [host::TEST4] TRANSFORMS-override_host = override_host
on transforms.conf on Heavy Forwarder:
[override_host] SOURCE_KEY = MetaData:Host REGEX = .* FORMAT = host::APP$1 DEST_KEY = MetaData:Host