Getting Data In

Overriding host values using the log data

pkeller
Contributor

http://docs.splunk.com/Documentation/Splunk/latest/Data/overridedefaulthostassignments

I've been trying to set up what should be a very simple regex to extract the hostname out of logs that are formatted like this:

Apr 20 10:10:10 host=hostname
Apr 20 10:10:11 host=hostname-b

After spending most of the day trying to do this, I decided to try doing what is listed in the Example section of the link mentioned at the top of this message. Using the exact same event data, the exact same props.conf and transforms.conf, my instance of Splunk running on my MacOS laptop is still setting the host field to my local hostname.

Thanks very much

Tags (2)
0 Karma

Damien_Dallimor
Ultra Champion

Well your regex won't work because you haven't escaped the special characters :

REGEX = ^[A-Z][a-z][a-z]\s+\d\d\s+\d\d:\d\d:\d\d\s+host=(\S+)\s+.*

FYI , alternatively, you can probably get away with a simpler regex, try this in transforms.conf

REGEX = host=([a-zA-Z0-9\._-]+)

pkeller
Contributor

Thank you ...

props.conf:

[source::.../unix-cads-alerts]
TRANSFORMS-cads = cads
SHOULD_LINEMERGE = false

transforms.conf
[cads]
DEST_KEY = MetaData:Host
REGEX = ^[A-Z][a-z][a-z]\s+\d\d\s+\d\d:\d\d:\d\d\s+host=(\S+)\s+.*
FORMAT = host::$1

here's two lines of data from the file: unix-cads-alerts

Apr 19 16:15:21 host=ctx-sjc-p33 alert=[CLEAR] details=[cpu10]
Apr 19 16:22:10 host=tab-app-002-p alert=[CLEAR] details=[snmp]

0 Karma

Damien_Dallimor
Ultra Champion

Can you post your props.conf and transforms.conf stanzas and I will take a look at it for you.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...