Getting Data In

How to replace the host in WinEventLog with the ComputerName field?

imrago
Contributor

My goal is to replace the host in WinEventLog events with the ComputerName field. The data is being forwarded from an UniversalForwarder and on the indexer these config files were used:

$splunkhome$/etc/system/local/props.conf

[WinEventLog:Security]
 TRANSFORMS-extract = winevent_hostoverride

$splunkhome$/etc/system/local/transforms.conf

[winevent-hostoverride]
 DEST_KEY = MetaData:Host
 REGEX = (?m)^ComputerName=([\S]*)
 FORMAT = host::$1

Tested the regex with this search:

sourcetype=Winevent*  | rex field=_raw "(?m)^ComputerName=(?<hostextract>[\S]*)" | table _time host hostextract

The value of the host remains unchanged. What could be wrong with these configs?
Is this the correct approach to solve the problem?

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Your configuration looks correct to me but be aware that you must bounce Splunk on each indexer before the changes will take effect and also note that this will only effect events AFTER the bounce; events already in the index are immutable and will not be effected. The basic rules are:

* The sourcetype matches WinEventLog:Security *exactly* (casing, punctuation, etc.).
* The configuration files are deployed the indexers or heavy forwarders (or universal forwarders in some cases, such as `INDEXED_EXTRACTIONS = csv`).
* You must restart/bounce all Splunk instances on the servers where you deploy it.
* There are no configuration errors during restart (watch the response text during startup on one server of each type).
* You are verifying function by looking at NEW data (post-deploy/post-bounce), not previously indexed data (which is immutable).

View solution in original post

woodcock
Esteemed Legend

Your configuration looks correct to me but be aware that you must bounce Splunk on each indexer before the changes will take effect and also note that this will only effect events AFTER the bounce; events already in the index are immutable and will not be effected. The basic rules are:

* The sourcetype matches WinEventLog:Security *exactly* (casing, punctuation, etc.).
* The configuration files are deployed the indexers or heavy forwarders (or universal forwarders in some cases, such as `INDEXED_EXTRACTIONS = csv`).
* You must restart/bounce all Splunk instances on the servers where you deploy it.
* There are no configuration errors during restart (watch the response text during startup on one server of each type).
* You are verifying function by looking at NEW data (post-deploy/post-bounce), not previously indexed data (which is immutable).

imrago
Contributor

Thanks for confirming that it looks good, it helped me to find the typo which caused the problem.

0 Karma

imrago
Contributor

winevent-hostoverride vs. winevent_hostoverride , just one character difference

0 Karma

woodcock
Esteemed Legend

And it was right there the whole time!

0 Karma

woodcock
Esteemed Legend

Well don't tease us; what was the problem and how did you isolate it? Maybe the details will help the next guy.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Are you looking at the host values of newly indexed fields or those of events indexed prior to setting props and transforms to these? This will only work on newly indexed fields.
Also, instead of ^\s you could use \S to increase readability.

0 Karma

imrago
Contributor

My goal is that in the newly arrived events, while indexing is happening to replace the received host value with the value of the ComputerName field.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Which is what these settings should do - but see the answer by woodcock, this will only work on new events (and only after a restart, obviously - see the answer by woodcock).

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...