Getting Data In

Creating Index time fields for your HF's

Jarohnimo
Builder

I'm trying to follow guides on how to create a new indexed field. Basically creating a field that gives us the name of the hf the data came from: "Splunk_HF"

Im having a hard time understanding how to actually grab the heavy forwarders name. If this was a raw log i would attempt to do regex on the host based on where that name in we can within the log but here in drawing a blank. It's like I'm pulling the info from the air and I simply don't know the right syntax to make this happen

I'm sure plenty have done it his before and it should be similar for each of us. Can someone please stir me in the right direction with my configurations

 

This is my idea so far, can someone please correct my mistakes


Transforms.conf
[getting_splunk_forwarder]
DEST_KEY = MetaData:Host
REGEX = I have no idea
Format = host::$1

Props.conf
TRANSFORMS-extract = getting_splunk_forwarder

Fields.conf
[getting_splunk_forwarder]
INDEXED = true

 

I really do appreciate splunk docs and generally people will post links for answers by themselves, but if someone could please show me the proper syntax in the stanza it will help me understand.

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A regex won't do since the name of the HF is not to be found in the data so it can't be extracted.  Consider using INGEST_EVAL to create the desired field.

Transforms.conf:

 

[getting_splunk_forwarder]
INGEST_EVAL = Splunk_HF="foo"

 

 Unfortunately, I believe the value needs to be hard-coded since Splunk can't take advantage of environment variables.

BTW, resist the urge to put the HF name in the host field.  You'll find it less useful than you think and you'll lose the original host of the data.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!