Getting Data In

How to rename host field value based on event data?

Kieffer87
Communicator

I have a Linux server that ingests pre-cooked log files. Each line of the log file begins with the host that the log originated from. I have a universal forwarder on a Linux server watching for log files and I would like to rename the host field from the linux server to use the server in the event line.

On the universal forwarder I added the following but host is still ldxx90vds19. What am I missing here? I'm in a distributed environment, tried adding the same to the search heads with no luck.

inputs.conf

[batch:///app1/vdsext/elk/stats/prod/pull/serverStats.*.csv.*]
source = ldxx90vds19
sourcetype = vds:serverstats
disabled = false
index = vds
move_policy = sinkhole
initCrcLength = 1000

props.conf

[vds:serverstats]
TRANSFORMS-hostname = vdshostname

transforms.conf

[vdshostname]
REGEX = ^[a-z]\w+
FORMAT = host::$1
DEST_KEY = MetaData:Host

Sample log:

ldxx90vds2,1493923501.828,0.685,0.652,97.793,0.802,0.0,0.067,0.050,0.060,0.030,11538391040.0,410136576.0,6964232192.0,6279286784.0,1276254.500,22937.400,0.0,39.300,0.0,1823129.600
0 Karma
1 Solution

somesoni2
Revered Legend

The universal forwarder doesn't do parsing of data so your props.conf and transforms.conf entries are ineffective there. Those should be kept in next Full Splunk instance, either heavy forwarder or indexer, to which your UF is sending data. A restart of Splunk would be required.

View solution in original post

somesoni2
Revered Legend

The universal forwarder doesn't do parsing of data so your props.conf and transforms.conf entries are ineffective there. Those should be kept in next Full Splunk instance, either heavy forwarder or indexer, to which your UF is sending data. A restart of Splunk would be required.

View solution in original post

Kieffer87
Communicator

I deployed the props.conf and transforms.conf to the indexer cluster and the host changed but it seems to just use $1 instead of the regex value.

0 Karma

somesoni2
Revered Legend

Change the REGEX = ^[a-z]\w+ with REGEX = ^([a-z]\w+). You need to enclose the value in brackets to be recognized as $1 (first enclosed value in regex)

Kieffer87
Communicator

That did the trick, thank you for your help.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!