How to replace the host in WinEventLog with the ComputerName field?

[imrago]

My goal is to replace the host in WinEventLog events with the ComputerName field. The data is being forwarded from an UniversalForwarder and on the indexer these config files were used:

$splunkhome$/etc/system/local/props.conf

[WinEventLog:Security]
 TRANSFORMS-extract = winevent_hostoverride

$splunkhome$/etc/system/local/transforms.conf

[winevent-hostoverride]
 DEST_KEY = MetaData:Host
 REGEX = (?m)^ComputerName=([\S]*)
 FORMAT = host::$1

Tested the regex with this search:

sourcetype=Winevent*  | rex field=_raw "(?m)^ComputerName=(?<hostextract>[\S]*)" | table _time host hostextract

The value of the host remains unchanged. What could be wrong with these configs?
Is this the correct approach to solve the problem?

[woodcock · Accepted solution]

Your configuration looks correct to me but be aware that you must bounce Splunk on each indexer before the changes will take effect and also note that this will only effect events AFTER the bounce; events already in the index are immutable and will not be effected. The basic rules are:

* The sourcetype matches WinEventLog:Security *exactly* (casing, punctuation, etc.).
* The configuration files are deployed the indexers or heavy forwarders (or universal forwarders in some cases, such as `INDEXED_EXTRACTIONS = csv`).
* You must restart/bounce all Splunk instances on the servers where you deploy it.
* There are no configuration errors during restart (watch the response text during startup on one server of each type).
* You are verifying function by looking at NEW data (post-deploy/post-bounce), not previously indexed data (which is immutable).

[imrago]

Thanks for confirming that it looks good, it helped me to find the typo which caused the problem.

[imrago]

winevent-hostoverride vs. winevent_hostoverride , just one character difference

[woodcock]

And it was right there the whole time!

[woodcock]

Well don't tease us; what was the problem and how did you isolate it? Maybe the details will help the next guy.

[jeffland]

Are you looking at the host values of newly indexed fields or those of events indexed prior to setting props and transforms to these? This will only work on newly indexed fields.
Also, instead of ^\s you could use \S to increase readability.

[imrago]

My goal is that in the newly arrived events, while indexing is happening to replace the received host value with the value of the ComputerName field.

[jeffland]

Which is what these settings should do - but see the answer by woodcock, this will only work on new events (and only after a restart, obviously - see the answer by woodcock).