Getting Data In

Host Override

carmackd
Communicator

I'm having trouble getting a host override to work. It appears Splunk is ignoring my transform (i assume because it's incorrect) and using the forwarder host value. My transform is sitting on the indexer, which is receiving the log source from a universal forwarder. The host value I'm trying to extract is in the file path, which is coming in as source.

Here is my transform:

[inhouseapp_override_host]
SOURCE_KEY=MetaData:Source
REGEX=source::^(?:\/[^\/]+){3}\/([^_]+)
FORMAT=host::$1
DEST_KEY=MetaData:Host

Here is the file path coming in as source:

/app/vault/inhouseapp/HostnameApp101_052011.log
1 Solution

dshpritz
SplunkTrust
SplunkTrust

Sorry, I think the "source::^" in your regex may be the problem. The "^" is saying "at the start of the string", but that isn't true in this case. Remove the "source::" and you should be ok.

Dave

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

Sorry, I think the "source::^" in your regex may be the problem. The "^" is saying "at the start of the string", but that isn't true in this case. Remove the "source::" and you should be ok.

Dave

carmackd
Communicator

thanks! good catch, that worked, but i removed the "^". If i remove the "source::" the new host name appears as "host=source::myapphost"

0 Karma

dshpritz
SplunkTrust
SplunkTrust

The regex looks right to me. What is in your props.conf?

Dave

0 Karma

carmackd
Communicator

[inhouseapp]

BREAK_ONLY_BEFORE_DATE = false

BREAK_ONLY_BEFORE = <\w+\s\d+,\s[0-9]{4}\s\S+\s\w+\s\w+>

TRANSFORMS-override = inhouseapp_override_host

I don't have the option to mark as code so the regex in BREAK_ONLY_BEFORE is coming through funny.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...