I have the following props and transfroms
[host::splunk-sh1] TRANSFORMS-vdisyslogs = set_host
[set_host] REGEX = [ies|wv|inn].*.mentorg.com DEST_KEY = MetaData:Host FORMAT = host::$1
But the host value is set to $1 and not the ies|wv|inn.*.mentorg.com. It works when I run the following search:
index="remoteaccess" sourcetype="vdi:syslogs" | rex field=_raw "(?<host>[ies|wv|inn].*.mentorg.com)"
What do I have wrong and why is it wrong?
I could see two issues.
2) Capture group is a MUST if you put FORMAT
[set_host] REGEX = ([ies|wv|inn].*?\.mentorg\.com) DEST_KEY = MetaData:Host FORMAT = host::$1
Your regex is technically correct, but the example shows
"(?<host>[ies|wv|inn].*.mentorg.com)" as regex where it will capture either its,wv, or inn followed by anything followed by mentors.com. In other words it captures the FQDN not just the host.
Does that make sense?
$SPLUNK_HOME/bin/splunk btool props list --debugand
$SPLUNK_HOME/bin/splunk btool transforms list --debugto see if your config is used
\.to match a
Beside that, out of ideas right now