Getting Data In

transforms.conf set hostname to current host

arjunpkishore5
Motivator

Hi,

Is there a way to use environment variables within transforms.conf. I am trying to override the hostname to the hostname of the forwarder which receives it.

I'm using the following. However, this doesn't seem to be working. The conf files are distributed from a deployment server, so I don't want to hard-code the host names

 

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = .
FORMAT = host::$HOSTNAME

 

 

Labels (1)
0 Karma

msimko_splunk
Splunk Employee
Splunk Employee

I don't have good news for you, but I do have some questions. 
 Sadly, I suspect what you are trying to do is outside the scope of transforms, especially when using a deployment server.

1.  Is this a heavyweight forwarder, or a universal forwarder?  

1a. If a Heavyweight, then how is the data being sent to it? From another forwarder?  
   1a1. If from a UF, then I suspect you'll have to write different apps, one for each HF.  This is far from ideal, but will get the job done. Hopefully you don't have too many HFs to have to create for these rules.
   1a2. If from a syslog or networking device you can just use the default hostname and the HF's hostname will be applied.

1b. If this is a universal forwarder, then is the data coming from another UF, or something like a syslog device?  
  1b1.  If from another UF you have issues coming. I don't think you can make this work.
  1b2. If from a syslog or network device, then use the default hostname, which will default to the forwarder.


Maybe someone else will have a better answer for you.

0 Karma

arjunpkishore5
Motivator

The source is HEC. The forwarders are on a load balanced url for HEC inputs. I'm trying to override the host from the LB url to the forwarder that receives it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust
That you're using a deployment server tells me the transforms.conf file is on a universal forwarder. If so, it's not working because UFs do not perform transforms. That's done by indexers and HFs.
---
If this reply helps you, an upvote would be appreciated.
0 Karma

arjunpkishore5
Motivator

Actually, This resides on a heavy forwarder.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!