We have a script running on <script-server> which produces the output as below. We are getting service stats running on different servers like Host-Server-A and Host-Server-B. Currently, the event is tagged to the server where the script is running. Can we change the configuration such that host=<Script-Server> will get replaced with Host.HostName in the event?
8/3/15
9:13:00.000 AM
KpiId="193"|kpiName="Error Count: <Host-Server-A>, <port>, Service-name"|IsService.Svc="Service-name"|Host.HostName="Host-Server"|IntegrationServer.Port="<port>"|IsPackage.Name="<service-folder>"|date="2015-08-03T09:13:00Z"|value="5.0"
host = <Script-Server> source = /opt/splunk/etc/apps/B2B/bin/runOptimizeScript.sh sourcetype = OptimizeData
8/3/15
9:13:00.000 AM
KpiId="193"|kpiName="Error Count: <Host-Server-B>, <port>, Service-name"|IsService.Svc="Service-name"|Host.HostName="Host-Server"|IntegrationServer.Port="<port>"|IsPackage.Name="<service-folder>"|date="2015-08-03T09:13:00Z"|value="5.0"
host = <Script-Server> source = /opt/splunk/etc/apps/B2B/bin/runOptimizeScript.sh sourcetype = OptimizeData
You need to create the following changes and then deploy them to each of your Indexers and restart the Splunk instances there.
In props.conf
:
[OptimizeData]
TRANSFORMS-hostoverride=hostoverride
In transforms.conf
:
[hostoverride]
DEST_KEY = MetaData:Host
REGEX = Error\s+Count:\s+([^,]+)
FORMAT = host::$1
The documentation is here:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/overridedefaulthostassignments
You need to create the following changes and then deploy them to each of your Indexers and restart the Splunk instances there.
In props.conf
:
[OptimizeData]
TRANSFORMS-hostoverride=hostoverride
In transforms.conf
:
[hostoverride]
DEST_KEY = MetaData:Host
REGEX = Error\s+Count:\s+([^,]+)
FORMAT = host::$1
The documentation is here:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/overridedefaulthostassignments
Hi,
Can you help me with REGEX if I want to capture value assigned to Host.HostName="Host-Server" ?
Thanks,
P
Use this:
REGEX = Error\s+Count:\s+([^,]+).*\|Host\.HostName="(?<HostServer>[^"]+)"
Thanks a lot ..