Getting Data In

Host Override

Communicator

I'm having trouble getting a host override to work. It appears Splunk is ignoring my transform (i assume because it's incorrect) and using the forwarder host value. My transform is sitting on the indexer, which is receiving the log source from a universal forwarder. The host value I'm trying to extract is in the file path, which is coming in as source.

Here is my transform:

[inhouseapp_override_host]
SOURCE_KEY=MetaData:Source
REGEX=source::^(?:\/[^\/]+){3}\/([^_]+)
FORMAT=host::$1
DEST_KEY=MetaData:Host

Here is the file path coming in as source:

/app/vault/inhouseapp/HostnameApp101_052011.log
1 Solution

SplunkTrust
SplunkTrust

Sorry, I think the "source::^" in your regex may be the problem. The "^" is saying "at the start of the string", but that isn't true in this case. Remove the "source::" and you should be ok.

Dave

View solution in original post

SplunkTrust
SplunkTrust

Sorry, I think the "source::^" in your regex may be the problem. The "^" is saying "at the start of the string", but that isn't true in this case. Remove the "source::" and you should be ok.

Dave

View solution in original post

Communicator

thanks! good catch, that worked, but i removed the "^". If i remove the "source::" the new host name appears as "host=source::myapphost"

0 Karma

SplunkTrust
SplunkTrust

The regex looks right to me. What is in your props.conf?

Dave

0 Karma

Communicator

[inhouseapp]

BREAK_ONLY_BEFORE_DATE = false

BREAK_ONLY_BEFORE = <\w+\s\d+,\s[0-9]{4}\s\S+\s\w+\s\w+>

TRANSFORMS-override = inhouseapp_override_host

I don't have the option to mark as code so the regex in BREAK_ONLY_BEFORE is coming through funny.

0 Karma