Getting Data In

Overwrites to multiple indexed fields possible in one transforms.conf stanza?

Runals
Motivator

We have some syslog feeds coming directly into an indexer. While this will eventually get addressed with forwarders I'd like to overwrite both the source and host indexed fields.
The forwarded syslogs looke like the following:

timestamp Forwarded from IP_address: whatever blah blah blah

and we are capturing the forwared from IP address in the following stanza

[forwarded]
DEST_KEY = MetaData:Host
REGEX = Forwarded\sfrom\s([^: ]+):
FORMAT = host::$1

Since I'd like to also grab the "whatever" and put it into the source field I'm wondering if I need to do that with a separate stanza in the transforms.conf file or if it can be included in the existing one. If it does require a second stanza in transforms can I call that from a second line in the props.conf stanza? For example

props.conf
[source blah]
TRANSFORMS-1=forwared
TRANSFORMS-2=forwared2

transforms.conf
[forwarded]
--as above--

[forwarded2]
DEST_KEY = MetaData:Source
REGEX = Forwarded\sfrom\s\d+\.\d+\.\d+\.\d+: (\S+)
FORMAT = source::$1

Have I overlooked anything?

Tags (1)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Because of needing to set DEST_KEY, I think your second approach with two different TRANSFORMS-xxx rules in props is the proper configuration.

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Because of needing to set DEST_KEY, I think your second approach with two different TRANSFORMS-xxx rules in props is the proper configuration.

0 Karma

Runals
Motivator

That was my thought/concern as well. Came into work this morning and added a second transforms call in the props and it did the trick. Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...