How to replace the host in the event with the output from an event?

[praspai]

We have a script running on <script-server> which produces the output as below. We are getting service stats running on different servers like Host-Server-A and Host-Server-B. Currently, the event is tagged to the server where the script is running. Can we change the configuration such that host=<Script-Server> will get replaced with Host.HostName in the event?

8/3/15 
9:13:00.000 AM  
KpiId="193"|kpiName="Error Count: <Host-Server-A>, <port>, Service-name"|IsService.Svc="Service-name"|Host.HostName="Host-Server"|IntegrationServer.Port="<port>"|IsPackage.Name="<service-folder>"|date="2015-08-03T09:13:00Z"|value="5.0"

host = <Script-Server> source = /opt/splunk/etc/apps/B2B/bin/runOptimizeScript.sh sourcetype = OptimizeData

8/3/15 
9:13:00.000 AM  
KpiId="193"|kpiName="Error Count: <Host-Server-B>, <port>, Service-name"|IsService.Svc="Service-name"|Host.HostName="Host-Server"|IntegrationServer.Port="<port>"|IsPackage.Name="<service-folder>"|date="2015-08-03T09:13:00Z"|value="5.0"

host = <Script-Server> source = /opt/splunk/etc/apps/B2B/bin/runOptimizeScript.sh sourcetype = OptimizeData

[woodcock · Accepted solution]

You need to create the following changes and then deploy them to each of your Indexers and restart the Splunk instances there.

In props.conf:

[OptimizeData]
TRANSFORMS-hostoverride=hostoverride

In transforms.conf:

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = Error\s+Count:\s+([^,]+)
FORMAT = host::$1

The documentation is here:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/overridedefaulthostassignments

[praspai]

Hi,

Can you help me with REGEX if I want to capture value assigned to Host.HostName="Host-Server" ?

Thanks,
P

[woodcock]

Use this:

REGEX = Error\s+Count:\s+([^,]+).*\|Host\.HostName="(?<HostServer>[^"]+)"

[praspai]

Thanks a lot ..