Getting Data In
Highlighted

Assigning host value based on data in event

SplunkTrust
SplunkTrust

I'm wondering if it's possible to set the host value for an event based on data within that event. Essentially I'm capturing snmp traps to a file that is monitored by Splunk. The first line of the event looks like this:

2011-02-24 13:29:09 remote-host [UDP: [10.1.1.11]:34438]:

...Now obviously when processed by Splunk it sets the host value of each event to the default host (the local system). However I would like to set it to the value of 'remote-host' that appears on the first line of each event. Is this possible?

Thanks!

Tags (2)
0 Karma
Highlighted

Re: Assigning host value based on data in event

Splunk Employee
Splunk Employee

Yes. This can be set at index time. In fact, if you take a look at the pre-defined "syslog" sourcetype in props.conf, you'll see rules that transform the host. The definition of the rule in transforms.conf is bit complicated because it's supposed to catch very general cases, but the principle should be the same.

View solution in original post

0 Karma
Highlighted

Re: Assigning host value based on data in event

SplunkTrust
SplunkTrust

That's perfect thanks, I dont know why I didn't even think of using a transform.

0 Karma