Host Override

[carmackd]

I'm having trouble getting a host override to work. It appears Splunk is ignoring my transform (i assume because it's incorrect) and using the forwarder host value. My transform is sitting on the indexer, which is receiving the log source from a universal forwarder. The host value I'm trying to extract is in the file path, which is coming in as source.

Here is my transform:

[inhouseapp_override_host]
SOURCE_KEY=MetaData:Source
REGEX=source::^(?:\/[^\/]+){3}\/([^_]+)
FORMAT=host::$1
DEST_KEY=MetaData:Host

Here is the file path coming in as source:

/app/vault/inhouseapp/HostnameApp101_052011.log

[dshpritz · Accepted solution]

Sorry, I think the "source::^" in your regex may be the problem. The "^" is saying "at the start of the string", but that isn't true in this case. Remove the "source::" and you should be ok.

Dave

[carmackd]

thanks! good catch, that worked, but i removed the "^". If i remove the "source::" the new host name appears as "host=source::myapphost"

[dshpritz]

The regex looks right to me. What is in your props.conf?

Dave

[carmackd]

[inhouseapp]

BREAK_ONLY_BEFORE_DATE = false

BREAK_ONLY_BEFORE = <\w+\s\d+,\s[0-9]{4}\s\S+\s\w+\s\w+>

TRANSFORMS-override = inhouseapp_override_host

I don't have the option to mark as code so the regex in BREAK_ONLY_BEFORE is coming through funny.