Getting Data In

Change hostname transform

Path Finder

We have a host where logs are aggregated already. I want to Splunk these logs. The source host for the logs is in the file path. I attempted the below props/transforms as a PoC, but no luck. Can anyone catch what I'm doing wrong?

transforms.conf:

[foobar]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Host
REGEX = ^/opt/splunk/v(ar)
FORMAT = host::bogus$1

props.conf:

[boguslog]
TRANSFORMS-foo=foobar

inputs.conf:

[monitor:///opt/splunk/var/log/splunk/splunkd.log]
sourcetype = boguslog

Also, would this sort of transformation work on a UF or only a HF? I was originally doing this to test for myself, but I can't get it to work on my HF in the first place.

0 Karma
1 Solution

Legend

Umm, aren't you making this a bit too difficult? Did you have a look at the host_segment configuration directive in inputs.conf?

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

View solution in original post

Legend

Umm, aren't you making this a bit too difficult? Did you have a look at the host_segment configuration directive in inputs.conf?

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

View solution in original post

Path Finder

You, sir, are kind of awesome. Using this with the UF actually shaves two weeks off my project by avoiding the heavy forwarder. Thank you!

0 Karma

Contributor

Correct behavior, props and transforms are not processed by a UF .

0 Karma

Path Finder

Fixed the transform, thanks to http://splunk-base.splunk.com/answers/24769/host-override.

The ^ in my regex was mucking things up. The MetaData:Source source begins with text "source::". Removing the ^ to permit the "source::" at the start of the value fixed it.

Still haven't gotten it to work on my UF though. Am I correct in understanding that this does not work on the UF?

0 Karma