Getting Data In

Why are my props.conf and transforms.conf configurations to set host values based on event data being ignored?

jlamirande_splu
Splunk Employee
Splunk Employee

In the Getting Data In documentation, it says I should be able to set host based on event data using props.conf and transforms.conf:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/overridedefaulthostassignments

For the following same data:

Sep 24 13:34:18 ca693292l2/10.0.1.140 ironkey: 02280706,2015-09-24T13:34:14Z,"E:/august.txt",5,2015-08-19T11:44:11,2015-08-19T11:44:20,2015-09-24T00:00:00,5D41402ABC4B2A76B9719D911017C592

My props.conf contains:

[test_ironkey]
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
[source::.../direct-to-syslog-ng-ik_syslog-ng.txt]
TRANSFORMS-extract = ironkey1
SHOULD_LINEMERGE = false

and my transforms.conf:

[ironkey1]
DEST_KEY = MetaData:Host
REGEX = ^\w+\s\d+\s\d\d:\d\d:\d\d\s(\w+) 
FORMAT = host::$1

but when I Add Data, it seems to ignore the props.conf and transforms.conf and use the localhost?

1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

I tested this with your sample data and the following configuration works where hostname is rewritten to ca693292l2:

apply to indexers
$SPLUNK_HOME/etc/system/local/props.conf (or if using indexer clustering deploy through the cluster master which will put the configs in: $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf)

[source::.../opt/splunkforwarder/customerlogs/syslog/test.log]
TRANSFORMS-force_host = force_host

$SPLUNK_HOME/etc/system/local/transforms.conf

[force_host]
REGEX = \w+\s\d+\s\d\d:\d\d:\d\d\s(\w+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
WRITE_META = true

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

I tested this with your sample data and the following configuration works where hostname is rewritten to ca693292l2:

apply to indexers
$SPLUNK_HOME/etc/system/local/props.conf (or if using indexer clustering deploy through the cluster master which will put the configs in: $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf)

[source::.../opt/splunkforwarder/customerlogs/syslog/test.log]
TRANSFORMS-force_host = force_host

$SPLUNK_HOME/etc/system/local/transforms.conf

[force_host]
REGEX = \w+\s\d+\s\d\d:\d\d:\d\d\s(\w+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
WRITE_META = true
Get Updates on the Splunk Community!

Buttercup Games Tutorial Extension - part 9

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games Tutorial Extension - part 8

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...