Assigning host value based on data in event

[joshd]

I'm wondering if it's possible to set the host value for an event based on data within that event. Essentially I'm capturing snmp traps to a file that is monitored by Splunk. The first line of the event looks like this:

2011-02-24 13:29:09 remote-host [UDP: [10.1.1.11]:34438]:

...Now obviously when processed by Splunk it sets the host value of each event to the default host (the local system). However I would like to set it to the value of 'remote-host' that appears on the first line of each event. Is this possible?

Thanks!

[gkanapathy · Accepted solution]

Yes. This can be set at index time. In fact, if you take a look at the pre-defined "syslog" sourcetype in props.conf, you'll see rules that transform the host. The definition of the rule in transforms.conf is bit complicated because it's supposed to catch very general cases, but the principle should be the same.

[joshd]

That's perfect thanks, I dont know why I didn't even think of using a transform.