Getting Data In
Highlighted

Host transforms not working

Communicator

Hello All,

I have the following props and transfroms

Props.conf

[host::splunk-sh1]
TRANSFORMS-vdisyslogs = set_host

Transforms.conf

[set_host]
REGEX = [ies|wv|inn].*.mentorg.com
DEST_KEY = MetaData:Host
FORMAT = host::$1

But the host value is set to $1 and not the ies|wv|inn.*.mentorg.com. It works when I run the following search:

index="remoteaccess" sourcetype="vdi:syslogs" 
| rex field=_raw "(?<host>[ies|wv|inn].*.mentorg.com)"

What do I have wrong and why is it wrong?

Thanks
ed

0 Karma
Highlighted

Re: Host transforms not working

Ultra Champion

Please try - REGEX = ([ies|wv|inn]).*.mentorg.com for the capture group.

0 Karma
Highlighted

Re: Host transforms not working

Communicator

Nope that did not work. The host field still shows up as $1

0 Karma
Highlighted

Re: Host transforms not working

SplunkTrust
SplunkTrust
  • check for typos
  • did you restart Splunk after the change?
  • check $SPLUNK_HOME/bin/splunk btool props list --debug and $SPLUNK_HOME/bin/splunk btool transforms list --debug to see if your config is used
  • Make sure the host name in the props stanza matches the entire name, not just a substring (and it is case sensitive 😉 )
  • Should not be a show stopper, but in the regex use a \. to match a .

Beside that, out of ideas right now ¯\_(ツ)_/¯

0 Karma
Highlighted

Re: Host transforms not working

SplunkTrust
SplunkTrust

almost 😉

Set the capturing group to be ([ies|wv|inn].*.mentorg.com) to be used as $1

cheers, MuS

View solution in original post

Highlighted

Re: Host transforms not working

Communicator

@MuS

Your answer was correct and worked.

Thanks
ed

0 Karma
Highlighted

Re: Host transforms not working

Ultra Champion

@MuS - why my cheerful REGEX = ([ies|wv|inn]).*.mentorg.com is broken? ; -) after all we want just ies or wv or inn?

0 Karma
Highlighted

Re: Host transforms not working

Communicator

@ddrillic

I was looking for the entire FQDN that would start with ies, wv or inn.

thanks
ed

0 Karma
Highlighted

Re: Host transforms not working

Ultra Champion

Got it, great @edwardrose - good luck and keep us posted.

0 Karma
Highlighted

Re: Host transforms not working

SplunkTrust
SplunkTrust

Your regex is technically correct, but the example shows "(?<host>[ies|wv|inn].*.mentorg.com)" as regex where it will capture either its,wv, or inn followed by anything followed by mentors.com. In other words it captures the FQDN not just the host.

Does that make sense?