Functionally, here's what I am looking to do.
I want to take the host (NJROS1BVA0597), append the source type (VM88 or VM11) identified in the props.conf and then re-write that to the host field.
So if the log is CAPPM_UPDATEDB.log, at the end of this, NJROS1BVA0597VM11 would be written to the host field.
My regex seems to be working In the format option, because the $0 gets me the original host name without a problem.
It's getting the source type to append to it, that is the problem.
My probably feeble attempt MetaData:Sourcetype does not work.
disabled = 0
host = NJROS1BVA0597
whitelist = \.log$
sourcetype = VM11
sourcetype = VM88
TRANSFORMS-hostname = rewrite_host
SOURCE_KEY = MetaData:Host
REGEX = .*
DEST_KEY = MetaData:Host
FORMAT = $0MetaData:Sourcetype
eper Splunk support, not possible
View solution in original post