Getting Data In

Overwrites to multiple indexed fields possible in one transforms.conf stanza?

Runals
Motivator

We have some syslog feeds coming directly into an indexer. While this will eventually get addressed with forwarders I'd like to overwrite both the source and host indexed fields.
The forwarded syslogs looke like the following:

timestamp Forwarded from IP_address: whatever blah blah blah

and we are capturing the forwared from IP address in the following stanza

[forwarded]
DEST_KEY = MetaData:Host
REGEX = Forwarded\sfrom\s([^: ]+):
FORMAT = host::$1

Since I'd like to also grab the "whatever" and put it into the source field I'm wondering if I need to do that with a separate stanza in the transforms.conf file or if it can be included in the existing one. If it does require a second stanza in transforms can I call that from a second line in the props.conf stanza? For example

props.conf
[source blah]
TRANSFORMS-1=forwared
TRANSFORMS-2=forwared2

transforms.conf
[forwarded]
--as above--

[forwarded2]
DEST_KEY = MetaData:Source
REGEX = Forwarded\sfrom\s\d+\.\d+\.\d+\.\d+: (\S+)
FORMAT = source::$1

Have I overlooked anything?

Tags (1)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Because of needing to set DEST_KEY, I think your second approach with two different TRANSFORMS-xxx rules in props is the proper configuration.

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Because of needing to set DEST_KEY, I think your second approach with two different TRANSFORMS-xxx rules in props is the proper configuration.

0 Karma

Runals
Motivator

That was my thought/concern as well. Came into work this morning and added a second transforms call in the props and it did the trick. Thanks!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...