Getting Data In

Assigning host value based on data in event

joshd
Builder

I'm wondering if it's possible to set the host value for an event based on data within that event. Essentially I'm capturing snmp traps to a file that is monitored by Splunk. The first line of the event looks like this:

2011-02-24 13:29:09 remote-host [UDP: [10.1.1.11]:34438]:

...Now obviously when processed by Splunk it sets the host value of each event to the default host (the local system). However I would like to set it to the value of 'remote-host' that appears on the first line of each event. Is this possible?

Thanks!

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes. This can be set at index time. In fact, if you take a look at the pre-defined "syslog" sourcetype in props.conf, you'll see rules that transform the host. The definition of the rule in transforms.conf is bit complicated because it's supposed to catch very general cases, but the principle should be the same.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Yes. This can be set at index time. In fact, if you take a look at the pre-defined "syslog" sourcetype in props.conf, you'll see rules that transform the host. The definition of the rule in transforms.conf is bit complicated because it's supposed to catch very general cases, but the principle should be the same.

0 Karma

joshd
Builder

That's perfect thanks, I dont know why I didn't even think of using a transform.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...