transforms.conf set hostname to current host

[arjunpkishore5]

Hi,

Is there a way to use environment variables within transforms.conf. I am trying to override the hostname to the hostname of the forwarder which receives it.

I'm using the following. However, this doesn't seem to be working. The conf files are distributed from a deployment server, so I don't want to hard-code the host names

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = .
FORMAT = host::$HOSTNAME

[msimko_splunk]

I don't have good news for you, but I do have some questions. 
 Sadly, I suspect what you are trying to do is outside the scope of transforms, especially when using a deployment server.

1.  Is this a heavyweight forwarder, or a universal forwarder?  

1a. If a Heavyweight, then how is the data being sent to it? From another forwarder?  
   1a1. If from a UF, then I suspect you'll have to write different apps, one for each HF.  This is far from ideal, but will get the job done. Hopefully you don't have too many HFs to have to create for these rules.
   1a2. If from a syslog or networking device you can just use the default hostname and the HF's hostname will be applied.

1b. If this is a universal forwarder, then is the data coming from another UF, or something like a syslog device?  
  1b1.  If from another UF you have issues coming. I don't think you can make this work.
  1b2. If from a syslog or network device, then use the default hostname, which will default to the forwarder.


Maybe someone else will have a better answer for you.

[arjunpkishore5]

The source is HEC. The forwarders are on a load balanced url for HEC inputs. I'm trying to override the host from the LB url to the forwarder that receives it.

[richgalloway]

That you're using a deployment server tells me the transforms.conf file is on a universal forwarder. If so, it's not working because UFs do not perform transforms. That's done by indexers and HFs.

[arjunpkishore5]

Actually, This resides on a heavy forwarder.