Getting Data In

Why are my props.conf and transforms.conf configurations to set host values based on event data being ignored?

Splunk Employee
Splunk Employee

In the Getting Data In documentation, it says I should be able to set host based on event data using props.conf and transforms.conf:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/overridedefaulthostassignments

For the following same data:

Sep 24 13:34:18 ca693292l2/10.0.1.140 ironkey: 02280706,2015-09-24T13:34:14Z,"E:/august.txt",5,2015-08-19T11:44:11,2015-08-19T11:44:20,2015-09-24T00:00:00,5D41402ABC4B2A76B9719D911017C592

My props.conf contains:

[test_ironkey]
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
[source::.../direct-to-syslog-ng-ik_syslog-ng.txt]
TRANSFORMS-extract = ironkey1
SHOULD_LINEMERGE = false

and my transforms.conf:

[ironkey1]
DEST_KEY = MetaData:Host
REGEX = ^\w+\s\d+\s\d\d:\d\d:\d\d\s(\w+) 
FORMAT = host::$1

but when I Add Data, it seems to ignore the props.conf and transforms.conf and use the localhost?

1 Solution

Splunk Employee
Splunk Employee

I tested this with your sample data and the following configuration works where hostname is rewritten to ca693292l2:

apply to indexers
$SPLUNK_HOME/etc/system/local/props.conf (or if using indexer clustering deploy through the cluster master which will put the configs in: $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf)

[source::.../opt/splunkforwarder/customerlogs/syslog/test.log]
TRANSFORMS-force_host = force_host

$SPLUNK_HOME/etc/system/local/transforms.conf

[force_host]
REGEX = \w+\s\d+\s\d\d:\d\d:\d\d\s(\w+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
WRITE_META = true

View solution in original post

Splunk Employee
Splunk Employee

I tested this with your sample data and the following configuration works where hostname is rewritten to ca693292l2:

apply to indexers
$SPLUNK_HOME/etc/system/local/props.conf (or if using indexer clustering deploy through the cluster master which will put the configs in: $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf)

[source::.../opt/splunkforwarder/customerlogs/syslog/test.log]
TRANSFORMS-force_host = force_host

$SPLUNK_HOME/etc/system/local/transforms.conf

[force_host]
REGEX = \w+\s\d+\s\d\d:\d\d:\d\d\s(\w+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
WRITE_META = true

View solution in original post

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!