Getting Data In

Why do some logs come into indexer with empty host field?

Adpafer
Loves-to-Learn Everything

Hi,

There are some logs that come to Indexer with empty host field (host= ). These logs come to main index and I would like them to come to another index. I have source and sourcetype.   I try to override index and route the logs to another index but it does not work. Here is my config. I would appreciate any help. Thx.

 

props:

[host:: ]
TRANSFORMS-myindex=override-index

 

transforms:

[override-index]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = myindex

 

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Adpafer ,

probably the issue is that in the regex of the override-index standa you have to put a regex that reads the value to assign to the host field, using "REGEX = ." you use a string not acceptable for the host index.

Probably in the first part of your logs, there's the hostname definition, you have to use that regex to assign a correct value to the host, e.g. having an event like the following

2023-05-29 11:22:54 my_hostname 12345 ...

you have to use a regex like the following:

REGEX = ^\d\d\d\-\d\d-\d\d\s\d\d:\d\d:\d\d\s($1)
DEST_KEY = MetaData:Host
FORMAT = host::$1

you can use the "REGEX = ." expression only if you want to assign a fixed value to the host field.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Any idea from where those are coming and why they didn't contain host value? Usually that should be there!
I try to figure out and fix this instead of trying send those to specific index with props and transforms.conf.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...