Getting Data In

How to replace the host in WinEventLog with the ComputerName field?

imrago
Contributor

My goal is to replace the host in WinEventLog events with the ComputerName field. The data is being forwarded from an UniversalForwarder and on the indexer these config files were used:

$splunkhome$/etc/system/local/props.conf

[WinEventLog:Security]
 TRANSFORMS-extract = winevent_hostoverride

$splunkhome$/etc/system/local/transforms.conf

[winevent-hostoverride]
 DEST_KEY = MetaData:Host
 REGEX = (?m)^ComputerName=([\S]*)
 FORMAT = host::$1

Tested the regex with this search:

sourcetype=Winevent*  | rex field=_raw "(?m)^ComputerName=(?<hostextract>[\S]*)" | table _time host hostextract

The value of the host remains unchanged. What could be wrong with these configs?
Is this the correct approach to solve the problem?

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Your configuration looks correct to me but be aware that you must bounce Splunk on each indexer before the changes will take effect and also note that this will only effect events AFTER the bounce; events already in the index are immutable and will not be effected. The basic rules are:

* The sourcetype matches WinEventLog:Security *exactly* (casing, punctuation, etc.).
* The configuration files are deployed the indexers or heavy forwarders (or universal forwarders in some cases, such as `INDEXED_EXTRACTIONS = csv`).
* You must restart/bounce all Splunk instances on the servers where you deploy it.
* There are no configuration errors during restart (watch the response text during startup on one server of each type).
* You are verifying function by looking at NEW data (post-deploy/post-bounce), not previously indexed data (which is immutable).

View solution in original post

woodcock
Esteemed Legend

Your configuration looks correct to me but be aware that you must bounce Splunk on each indexer before the changes will take effect and also note that this will only effect events AFTER the bounce; events already in the index are immutable and will not be effected. The basic rules are:

* The sourcetype matches WinEventLog:Security *exactly* (casing, punctuation, etc.).
* The configuration files are deployed the indexers or heavy forwarders (or universal forwarders in some cases, such as `INDEXED_EXTRACTIONS = csv`).
* You must restart/bounce all Splunk instances on the servers where you deploy it.
* There are no configuration errors during restart (watch the response text during startup on one server of each type).
* You are verifying function by looking at NEW data (post-deploy/post-bounce), not previously indexed data (which is immutable).

View solution in original post

imrago
Contributor

Thanks for confirming that it looks good, it helped me to find the typo which caused the problem.

0 Karma

imrago
Contributor

winevent-hostoverride vs. winevent_hostoverride , just one character difference

0 Karma

woodcock
Esteemed Legend

And it was right there the whole time!

0 Karma

woodcock
Esteemed Legend

Well don't tease us; what was the problem and how did you isolate it? Maybe the details will help the next guy.

0 Karma

jeffland
Champion

Are you looking at the host values of newly indexed fields or those of events indexed prior to setting props and transforms to these? This will only work on newly indexed fields.
Also, instead of ^\s you could use \S to increase readability.

0 Karma

imrago
Contributor

My goal is that in the newly arrived events, while indexing is happening to replace the received host value with the value of the ComputerName field.

0 Karma

jeffland
Champion

Which is what these settings should do - but see the answer by woodcock, this will only work on new events (and only after a restart, obviously - see the answer by woodcock).

0 Karma