Guys,
I need a help.
I've configured the props and transforms to change the host field from a lambda function I'm collecting the logs.
I can see the new host, but I not find anything when I search the new host with host=....
I done this configuration in heavy forwarder. This heavy forwarder concentrate the logs and sends it to a splunk cluster with two indexers and auto load balancing configuration.
The host that I'm trying to change is coming from a lambda function from guradduty.
props.conf
[aws:cloudwatch:guardduty]
TRANSFORMS-client = rename_host_guardduty
SHOULD_LINEMERGE = false
transforms.conf
[rename_host_guardduty]
DEST_KEY = MetaData:Host
REGEX = .*
FORMAT = guardduty
Any ideas?
Thank you.
Hello,
I think you should change format to:
FORMAT = host::guardduty
Kind regards,
Willem
Hello,
I think you should change format to:
FORMAT = host::guardduty
Kind regards,
Willem
Hi Willem,
I'll try here.
Thank you.