Getting Data In

transforms.conf

VijaySrrie
Builder

Hi,

How to write transforms.conf for the fields that are not present in metadata

For example, I need to write transforms for the field - asset_env

asset_env = PROD

Below transforms were not working.

[change_index_name]
SOURCE_KEY = field:asset_env
REGEX = ^asset_env::(\w+)
DEST_KEY = _MetaData:Index
FORMAT = index_$1
~
~

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @VijaySrrie,

let me understand: you want to create an index based on a condition (e.g. if host=host_prod, env=PROD otherwise is env=DEV), is it correct?

in this case you can create a calculated field [Settings -- Fields -- Calculated fields -- New calculated field] adding the rule for your sourcetype, e.g. for the above example

env=if(host=host_prod,"PROD","DEV")

 Ciao.

Giuseppe

0 Karma

VijaySrrie
Builder

Host = abcdpr,xyzpr,abcps,xyzps etc......

asset_env = PROD,PSUP,PSVT etc...

We have different different asset_env like asset_env = PROD, asset_env=PSVT, asset_env=PSUP likewise.

I will create index like (index_PROD, index_PSUP, index_PSVT)

Based on the transforms.conf, the logs based on  asset_env should go to respective index

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @VijaySrrie,

The easiest way is to manage the correct index addressingusing diferent inputs.conf for each host (you can manage them using a Deployment Server).

Otherwise you could override index on Indexers (of on Heavy Forwarders if present) based on the host value, something like this:

on props.conf

[host::host_PROD]
TRANSFORMS-override_index_PROD = override_index_PROD

[host::host_DEV]
TRANSFORMS-override_index_DEV = override_index_DEV

on transforms.conf

[override_index_PROD]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = index_PROD

[override_index_DEV]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = index_DEV

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...