How do I set hostname without syslog

[I_am_Jeff]

I have a UF sending logs to my indexer. The UF receives logs, via syslog, from several other systems. All my UFs, indexers, and search heads are Splunk 4.2.3 and running Red Hat Linux. The logs go to a custom index, not main.

I'd like to extract the hostname from the events so I can search for host=hostname. I know the hostname is between AB: and the next colon, and believe I have the regex to do that. I believe I have to do this on the indexers.

 2012-01-13 16:05:44,528 weblogic:[ExecuteThread: '20' for queue: 'webapp.queue']AB:hostname:1234567:autofoo

I've done this on a standalone implementation where the log is written to a file by syslog, but how do I do it with forwarders, multiple indexers and search heads? Right now host= the name of the UF box, not the "correct" hostnames.

[Damien_Dallimor · Accepted solution]

You could perform an index time transform on the host field.
Add entrys to props.conf and transforms.conf in the "local" directory for the app on the Universal Forwarder.My regex example is a bit generic, you might want to tighten it up a bit based on the actual patterns in your logs.

#props.conf
[my_sourcetype]
TRANSFORMS-host = my_sourcetype_host

#transforms.conf
[my_sourcetype_host]
DEST_KEY = MetaData:Host
REGEX = ^.+AB:(\w+):\d+:\w+
FORMAT = host::$1

[Damien_Dallimor]

regex = ^.+(?:AB|CD):(\w+):\d+:\w+

Yep , the files get deployed to the UF.

[I_am_Jeff]

Working on getting this implemented using a Deployment Server. The regex needs some work as I have an AB: or CD: situation. (That shouldn't be a big deal.) The props.conf and transforms.conf go on the UF, huh, not on the indexer? $SPLUNK_HOME/etc/apps/jeff/local/{props.conf|transforms.conf}