I have a sql that returns rows with values MachineName, Errors
ABC 5
DEF 3
I would like value of MACHINENAME column to be assigned to the host variable.
I read this article
http://www.splunk.com/base/Documentation/latest/Admin/Overridedefaulthostassignments
but wasn't sure how to set the host variable in my particular case.
My Transforms file looks like
[xmlkv-extraction]
MV_ADD = true
REPEAT_MATCH = true
REGEX = <([^\s>])[^>]>([^<]*)\<\/\1>
FORMAT = $1::$2
and Props looks like
[ErrorMissingObject]
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = False
LINE_BREAKER = ()
REPORT-xmlkv = xmlkv-extraction
I am wondering if I can use REPORT-xmlkv and TRANSFORM-xmlv in one file
host
is one of the very few fields assigned at index time, so it works a little differently than most field extractions.
The link you already found is the right starting point, but maybe this will help clarify.
transforms.conf:
[override-hostname]
DEST_KEY = MetaData:Host
REGEX = ^(\S+)
FORMAT = host::$1
props.conf:
[ErrorMissingObject]
TRANSFORMS-host = override-hostname
In transforms.conf, we're telling it to match as many non-space characters as possible at the beginning of a line. Then, assign it to the hosts value. In props.conf, note that you need to use TRANSFORMS-xxx
instead of REPORT-xxx
, since this is happening at index time.
Props.conf is what tells Splunk to actually apply the transform we defined to your data.
I'm assuming from your current props.conf that ErrorMissingObject
is the sourcetype for these entries.
You can just add the TRANSFORMS-host
line to what's already there.