Host rewrite not working...

[responsys_cm]

I'm trying to rewrite the host field based upon values in my data. Here is a sample event:

{"href":"/orgs/1/audit_log_events/2c2b3a2d-eda4-4391-adcc-8feb309da406","event_type":"proc_stopped","severity":"info","timestamp":"2018-07-25T19:13:50+00:00","created_by":{"server":{"hostname":"#######","href":"/orgs/1/agents/5654"}},"data":{"reporter_proc":"AgentMonitor","reporter_pid":4150,"stopped_proc":"AgentMonitor"}}

Here is my transforms.conf:

[illumio_host_rewrite]
REGEX = created_by\":{\"server\":{\"hostname\":\"([^\"]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host

Here is my props.conf:
[illumio:audit]
TRANSFORMS-illumio_host_rewrite = illumio_host_rewrite

I verified that the regex worked using the "regex" search command. I pushed it out to the indexing tier and the host value hasn't changed. I pushed it out to the system that connects to the Illumio API with the exact same config, but that didn't work either. Except on the collector machine, I'm seeing an error message that says:

07-25-2018 12:12:41.582 -0700 ERROR regexExtractionProcessor - REGEX field must be specified tranform_name=illumio_host_rewrite

I'm not seeing that error on the indexers though. Both hosts are running Oracle Linux.

Any ideas why that isn't working...?

[somesoni2]

Try this for your transforms.conf stanza (assuming there is no other key named hostname in your data.

[illumio_host_rewrite]
REGEX = \"hostname\":\"([^\"]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host

[MuS]

Hi responsys_cm,

is indexing tier doing the parsing, being the first full Splunk instance that receives those events? Did you restart the Splunk instances after you allied the props.conf,transforms.conf? Any typo in the sourcetype name?

Also, you should add these to your transforms.conf:

SOURCE_KEY = MetaData:Host

and consider this as well:

WRITE_META = [true|false]
* NOTE: This attribute is only valid for index-time field extractions.
* Automatically writes REGEX to metadata.
* Required for all index-time field extractions except for those where
  DEST_KEY = _meta (see the description of the DEST_KEY attribute, below)
* Use instead of DEST_KEY = _meta.
* Defaults to false.

See the docs for more on this http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf .

Not to forget to check splunk btool props list illumio:audit --debug and splunk btool transforms list illumio_host_rewrite --debug to see if your configs will be actually used by Splunk or if there is a conflict and some other config takes precedence.

Hope this helps ...

cheers, MuS