Reporting

How to set the value of host variable

danurag
Explorer

I have a sql that returns rows with values MachineName, Errors

ABC 5
DEF 3

I would like value of MACHINENAME column to be assigned to the host variable.

I read this article

http://www.splunk.com/base/Documentation/latest/Admin/Overridedefaulthostassignments

but wasn't sure how to set the host variable in my particular case.

My Transforms file looks like

[xmlkv-extraction]
MV_ADD = true
REPEAT_MATCH = true
REGEX = <([^\s>])[^>]>([^<]*)\<\/\1>
FORMAT = $1::$2

and Props looks like

[ErrorMissingObject]
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = False
LINE_BREAKER = ()
REPORT-xmlkv = xmlkv-extraction

I am wondering if I can use REPORT-xmlkv and TRANSFORM-xmlv in one file

Tags (2)
0 Karma

southeringtonp
Motivator

host is one of the very few fields assigned at index time, so it works a little differently than most field extractions.

The link you already found is the right starting point, but maybe this will help clarify.

transforms.conf:

[override-hostname]
DEST_KEY = MetaData:Host
REGEX = ^(\S+)
FORMAT = host::$1

props.conf:

[ErrorMissingObject]
TRANSFORMS-host = override-hostname

In transforms.conf, we're telling it to match as many non-space characters as possible at the beginning of a line. Then, assign it to the hosts value. In props.conf, note that you need to use TRANSFORMS-xxx instead of REPORT-xxx, since this is happening at index time. Props.conf is what tells Splunk to actually apply the transform we defined to your data.

I'm assuming from your current props.conf that ErrorMissingObject is the sourcetype for these entries. You can just add the TRANSFORMS-host line to what's already there.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...