Why are my props.conf and transforms.conf configurations to set host values based on event data being ignored?

[jlamirande_splu]

In the Getting Data In documentation, it says I should be able to set host based on event data using props.conf and transforms.conf:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/overridedefaulthostassignments

For the following same data:

Sep 24 13:34:18 ca693292l2/10.0.1.140 ironkey: 02280706,2015-09-24T13:34:14Z,"E:/august.txt",5,2015-08-19T11:44:11,2015-08-19T11:44:20,2015-09-24T00:00:00,5D41402ABC4B2A76B9719D911017C592

My props.conf contains:

[test_ironkey]
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
[source::.../direct-to-syslog-ng-ik_syslog-ng.txt]
TRANSFORMS-extract = ironkey1
SHOULD_LINEMERGE = false

and my transforms.conf:

[ironkey1]
DEST_KEY = MetaData:Host
REGEX = ^\w+\s\d+\s\d\d:\d\d:\d\d\s(\w+) 
FORMAT = host::$1

but when I Add Data, it seems to ignore the props.conf and transforms.conf and use the localhost?

[rphillips_splk · Accepted solution]

I tested this with your sample data and the following configuration works where hostname is rewritten to ca693292l2:

apply to indexers
$SPLUNK_HOME/etc/system/local/props.conf (or if using indexer clustering deploy through the cluster master which will put the configs in: $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf)

[source::.../opt/splunkforwarder/customerlogs/syslog/test.log]
TRANSFORMS-force_host = force_host

$SPLUNK_HOME/etc/system/local/transforms.conf

[force_host]
REGEX = \w+\s\d+\s\d\d:\d\d:\d\d\s(\w+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
WRITE_META = true