Splunk Enterprise

Field Transformation from Host Tags (tag::host)

jensparks
New Member

I'm looking to set up a field transformation (with no access to transforms.conf) for my department's logs to be able to differentiate our data centers and environments. For some reason, the configuration I've put in doesn't appear to be working, though no errors are returned.

Setup (made generic):

  1. A tag is configured on 'host' to be one of the following: app_prod_njw, app_prod_bel, app_preprod_njw, or app_preprod_bel
  2. A new private field transformation has been created with the following configuration:
    • name: app-env-datacenter
    • type: regex-based
    • Regular expression: app_(?<env>\w+)_(?<datacenter>.+)
    • Format: env::$1 datacenter::$2
    • Source key: tag::host
    • "Create multivalued fields" is not selected
    • "Automatically clean field names" is not selected

When I run a given search for my logs, however, I'm not seeing the field env or the field datacenter. 

I've also double-checked my regex and checked with a couple 

Is there some inherent misunderstanding in this setup? Is it not possible to do this against 'tag::host' as a source key?

Any and all help is appreciated!!!

~ Jen

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...