Getting Data In

Change host props and transforms not working

wvalente
Explorer

Guys,

I need a help.

I've configured the props and transforms to change the host field from a lambda function I'm collecting the logs.

I can see the new host, but I not find anything when I search the new host with host=....

I done this configuration in heavy forwarder. This heavy forwarder concentrate the logs and sends it to a splunk cluster with two indexers and auto load balancing configuration.

The host that I'm trying to change is coming from a lambda function from guradduty.

props.conf

[aws:cloudwatch:guardduty]
TRANSFORMS-client = rename_host_guardduty
SHOULD_LINEMERGE = false

transforms.conf

[rename_host_guardduty]
DEST_KEY = MetaData:Host
REGEX = .*
FORMAT = guardduty

Any ideas?

Thank you.

Labels (3)
0 Karma
1 Solution

willemjongeneel
Communicator

Hello,

I think you should change format to: 

FORMAT = host::guardduty

Kind regards,

Willem

View solution in original post

0 Karma

willemjongeneel
Communicator

Hello,

I think you should change format to: 

FORMAT = host::guardduty

Kind regards,

Willem

0 Karma

wvalente
Explorer

Hi Willem.

I've done here and it's work very well.

Thank you so much.

Tags (1)
0 Karma

wvalente
Explorer

Hi Willem,

I'll try here.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...