Getting Data In

How to set at the same time in transforms.conf a new index and set a new metadata  based on the host name?

FrankFZ
Engager

Hi, I need to set at the same time in transforms.conf a new index and set a new metadata  based on the host name.

New index=switchoob New metadata=tecnologia

Like this:
[force_IndexVMW]
SOURCE_KEY = MetaData:Host
REGEX = ^ob\w+
DEST_KEY = _MetaData:Index
FORMAT = switchoob

[force_tecnologiaVMW]
SOURCE_KEY = MetaData:Host
REGEX = ^ob\w+
DEST_KEY = _meta
FORMAT = NFV_SITE::DC02_MIBER tecnologia::vmw

I have tried to find "More than one DEST_KEY" article but the link is wrong.

Thank You

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@FrankFZ - Please confirm the following things on your environment.

  • You have mentioned these two transforms stanzas in props.conf in the right source/sourcetype/host.
  • You have deployed this configuration at the parsing stage. Generally Indexer and Heavy Forwarder.
  • Make sure you are exporting this configuration to system level with local.meta or default.meta - https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Defaultmetaconf 

 

You also need to add fields.conf on Search Head:

[tecnologia]
INDEXED=true

[NFV_SITE]
INDEXED=true

 

transforms.conf

[force_IndexVMW]
SOURCE_KEY = MetaData:Host
REGEX = ^ob\w+
DEST_KEY = _MetaData:Index
FORMAT = switchoob

[force_tecnologiaVMW]
SOURCE_KEY = MetaData:Host
REGEX = ^ob\w+
WRITE_META = true
FORMAT = NFV_SITE::DC02_MIBER tecnologia::vmw

 

I hope this helps!!! Upvote/Karma would be appreciated!!!

FrankFZ
Engager

Thanks very much for your suggestions. Do you confirm that the configuration of the transforms.conf file allows me to perform 2 redirections? One for the index and one for the meta field for the same hosts? Thank You!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Yes, that shouldn't be a problem.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...