Getting Data In

Overriding host-field

dav_muel
Engager

Hi,

I have events like this:

server=serverA
field1=foo
field2=bar

And I would like to override the host-field with serverA so I configured on our indexers:

props.conf

[foo:bar]
DATETIME_CONFIG = CURRENT
LINE_BREAKER = field2=.*([\r\n]+)
SHOULD_LINEMERGE = false
TRANSFORMS-A = trans_host

transforms.conf

[trans_host]
REGEX = SERVER\=(\w+)$
FORMAT = host::$1
DEST_KEY = MetaData::host

 

But it's not working.. I still get the original host-value.
What am I missing here?

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Yes, because on your sample data it is uppercase. Since regex work case sensitive , it should work.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

scelikok
SplunkTrust
SplunkTrust

Hi @dav_muel,

Your problem maybe in REGEX, please try below.

[trans_host]
REGEX = server\=(\w+)
FORMAT = host::$1
DEST_KEY = MetaData::host
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Funderburg78
Path Finder

So what your saying is he needs to use lowercase server instead of uppercase server?.?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...