I have a reg ex tested and working that will extract the host out of these events. My transforms is as follows:
[hostextraction]
REGEX = ^.*\d+\s(.*)ASM:.*
FORMAT = host::$1
DEST_KEY = MetaData:Host
props:
[myst]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
TIME_PREFIX = ^.{1,16}\b(?:\d{1,3}\.){3}\d{1,3}\b\s
TRANSFORMS-whateva = hostextraction
This has no affect on the host metadata key. Any help is much appreciated. I am taking this directly from Splunk Documentation. I am getting this message in _internal
ERROR regexExtractionProcessor - REGEX field must be specified tranform_name=hostextraction
Any help is much appreciated!
