Trying to override host metadata w/ regex on source, but events are arriving at indexers w/ forwarding servers hostname?

[stepheneardley]

I'm trying to override the host metadata with a regex on source but it's not working as expected.  The events are arriving at the indexers with the forwarding server's hostname  I've referenced a few similar issues from the community site in my attempt but I'm not having much luck.  Can anyone see what's wrong please?  In the below example the host metadata should be overridden with host1.

Input

[monitor:///opt/pyLogger/logs/host1]
SHOULD_LINEMERGE = False
sourcetype = network

Props

[network]
TRANSFORMS-host=overridehost

Transforms

[overridehost]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Host
REGEX = (\w+)$
FORMAT = host::$1

The data is arriving at the indexers with the host set to the server the forwarder is running on.  

[richgalloway · Accepted solution]

The current config, when it works, would set the host name to the last word of the log filename.  That is, for example, "log".  I suspect that's not the desired result.  Fortunately, Splunk has a solution for this.  The host_segment setting in inputs.conf tells Splunk to pull the host name from a specific part of the monitored file's path.  There's no need for props and transforms.

[monitor:///opt/pyLogger/logs/host1]
SHOULD_LINEMERGE = False
sourcetype = network
host_segment = 4

[stepheneardley]

Magic.  Thanks Rich.