Getting Data In

How to rename host field value based on event data?

Kieffer87
Communicator

I have a Linux server that ingests pre-cooked log files. Each line of the log file begins with the host that the log originated from. I have a universal forwarder on a Linux server watching for log files and I would like to rename the host field from the linux server to use the server in the event line.

On the universal forwarder I added the following but host is still ldxx90vds19. What am I missing here? I'm in a distributed environment, tried adding the same to the search heads with no luck.

inputs.conf

[batch:///app1/vdsext/elk/stats/prod/pull/serverStats.*.csv.*]
source = ldxx90vds19
sourcetype = vds:serverstats
disabled = false
index = vds
move_policy = sinkhole
initCrcLength = 1000

props.conf

[vds:serverstats]
TRANSFORMS-hostname = vdshostname

transforms.conf

[vdshostname]
REGEX = ^[a-z]\w+
FORMAT = host::$1
DEST_KEY = MetaData:Host

Sample log:

ldxx90vds2,1493923501.828,0.685,0.652,97.793,0.802,0.0,0.067,0.050,0.060,0.030,11538391040.0,410136576.0,6964232192.0,6279286784.0,1276254.500,22937.400,0.0,39.300,0.0,1823129.600
0 Karma
1 Solution

somesoni2
Revered Legend

The universal forwarder doesn't do parsing of data so your props.conf and transforms.conf entries are ineffective there. Those should be kept in next Full Splunk instance, either heavy forwarder or indexer, to which your UF is sending data. A restart of Splunk would be required.

View solution in original post

somesoni2
Revered Legend

The universal forwarder doesn't do parsing of data so your props.conf and transforms.conf entries are ineffective there. Those should be kept in next Full Splunk instance, either heavy forwarder or indexer, to which your UF is sending data. A restart of Splunk would be required.

Kieffer87
Communicator

I deployed the props.conf and transforms.conf to the indexer cluster and the host changed but it seems to just use $1 instead of the regex value.

0 Karma

somesoni2
Revered Legend

Change the REGEX = ^[a-z]\w+ with REGEX = ^([a-z]\w+). You need to enclose the value in brackets to be recognized as $1 (first enclosed value in regex)

Kieffer87
Communicator

That did the trick, thank you for your help.

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...