Getting Data In

How to rename host field value based on event data?

Kieffer87
Communicator

I have a Linux server that ingests pre-cooked log files. Each line of the log file begins with the host that the log originated from. I have a universal forwarder on a Linux server watching for log files and I would like to rename the host field from the linux server to use the server in the event line.

On the universal forwarder I added the following but host is still ldxx90vds19. What am I missing here? I'm in a distributed environment, tried adding the same to the search heads with no luck.

inputs.conf

[batch:///app1/vdsext/elk/stats/prod/pull/serverStats.*.csv.*]
source = ldxx90vds19
sourcetype = vds:serverstats
disabled = false
index = vds
move_policy = sinkhole
initCrcLength = 1000

props.conf

[vds:serverstats]
TRANSFORMS-hostname = vdshostname

transforms.conf

[vdshostname]
REGEX = ^[a-z]\w+
FORMAT = host::$1
DEST_KEY = MetaData:Host

Sample log:

ldxx90vds2,1493923501.828,0.685,0.652,97.793,0.802,0.0,0.067,0.050,0.060,0.030,11538391040.0,410136576.0,6964232192.0,6279286784.0,1276254.500,22937.400,0.0,39.300,0.0,1823129.600
0 Karma
1 Solution

somesoni2
Revered Legend

The universal forwarder doesn't do parsing of data so your props.conf and transforms.conf entries are ineffective there. Those should be kept in next Full Splunk instance, either heavy forwarder or indexer, to which your UF is sending data. A restart of Splunk would be required.

View solution in original post

somesoni2
Revered Legend

The universal forwarder doesn't do parsing of data so your props.conf and transforms.conf entries are ineffective there. Those should be kept in next Full Splunk instance, either heavy forwarder or indexer, to which your UF is sending data. A restart of Splunk would be required.

Kieffer87
Communicator

I deployed the props.conf and transforms.conf to the indexer cluster and the host changed but it seems to just use $1 instead of the regex value.

0 Karma

somesoni2
Revered Legend

Change the REGEX = ^[a-z]\w+ with REGEX = ^([a-z]\w+). You need to enclose the value in brackets to be recognized as $1 (first enclosed value in regex)

Kieffer87
Communicator

That did the trick, thank you for your help.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...