Getting Data In

Assigning host value based on data in event

joshd
SplunkTrust
SplunkTrust

I'm wondering if it's possible to set the host value for an event based on data within that event. Essentially I'm capturing snmp traps to a file that is monitored by Splunk. The first line of the event looks like this:

2011-02-24 13:29:09 remote-host [UDP: [10.1.1.11]:34438]:

...Now obviously when processed by Splunk it sets the host value of each event to the default host (the local system). However I would like to set it to the value of 'remote-host' that appears on the first line of each event. Is this possible?

Thanks!

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes. This can be set at index time. In fact, if you take a look at the pre-defined "syslog" sourcetype in props.conf, you'll see rules that transform the host. The definition of the rule in transforms.conf is bit complicated because it's supposed to catch very general cases, but the principle should be the same.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Yes. This can be set at index time. In fact, if you take a look at the pre-defined "syslog" sourcetype in props.conf, you'll see rules that transform the host. The definition of the rule in transforms.conf is bit complicated because it's supposed to catch very general cases, but the principle should be the same.

View solution in original post

0 Karma

joshd
SplunkTrust
SplunkTrust

That's perfect thanks, I dont know why I didn't even think of using a transform.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.