Getting Data In

Host Override

carmackd
Communicator

I'm having trouble getting a host override to work. It appears Splunk is ignoring my transform (i assume because it's incorrect) and using the forwarder host value. My transform is sitting on the indexer, which is receiving the log source from a universal forwarder. The host value I'm trying to extract is in the file path, which is coming in as source.

Here is my transform:

[inhouseapp_override_host]
SOURCE_KEY=MetaData:Source
REGEX=source::^(?:\/[^\/]+){3}\/([^_]+)
FORMAT=host::$1
DEST_KEY=MetaData:Host

Here is the file path coming in as source:

/app/vault/inhouseapp/HostnameApp101_052011.log
1 Solution

dshpritz
SplunkTrust
SplunkTrust

Sorry, I think the "source::^" in your regex may be the problem. The "^" is saying "at the start of the string", but that isn't true in this case. Remove the "source::" and you should be ok.

Dave

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

Sorry, I think the "source::^" in your regex may be the problem. The "^" is saying "at the start of the string", but that isn't true in this case. Remove the "source::" and you should be ok.

Dave

carmackd
Communicator

thanks! good catch, that worked, but i removed the "^". If i remove the "source::" the new host name appears as "host=source::myapphost"

0 Karma

dshpritz
SplunkTrust
SplunkTrust

The regex looks right to me. What is in your props.conf?

Dave

0 Karma

carmackd
Communicator

[inhouseapp]

BREAK_ONLY_BEFORE_DATE = false

BREAK_ONLY_BEFORE = <\w+\s\d+,\s[0-9]{4}\s\S+\s\w+\s\w+>

TRANSFORMS-override = inhouseapp_override_host

I don't have the option to mark as code so the regex in BREAK_ONLY_BEFORE is coming through funny.

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...