Getting Data In

Overriding host-field

dav_muel
Engager

Hi,

I have events like this:

server=serverA
field1=foo
field2=bar

And I would like to override the host-field with serverA so I configured on our indexers:

props.conf

[foo:bar]
DATETIME_CONFIG = CURRENT
LINE_BREAKER = field2=.*([\r\n]+)
SHOULD_LINEMERGE = false
TRANSFORMS-A = trans_host

transforms.conf

[trans_host]
REGEX = SERVER\=(\w+)$
FORMAT = host::$1
DEST_KEY = MetaData::host

 

But it's not working.. I still get the original host-value.
What am I missing here?

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Yes, because on your sample data it is uppercase. Since regex work case sensitive , it should work.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

scelikok
SplunkTrust
SplunkTrust

Hi @dav_muel,

Your problem maybe in REGEX, please try below.

[trans_host]
REGEX = server\=(\w+)
FORMAT = host::$1
DEST_KEY = MetaData::host
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Funderburg78
Path Finder

So what your saying is he needs to use lowercase server instead of uppercase server?.?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...