Splunk Enterprise

Field Transformation from Host Tags (tag::host)

jensparks
New Member

I'm looking to set up a field transformation (with no access to transforms.conf) for my department's logs to be able to differentiate our data centers and environments. For some reason, the configuration I've put in doesn't appear to be working, though no errors are returned.

Setup (made generic):

  1. A tag is configured on 'host' to be one of the following: app_prod_njw, app_prod_bel, app_preprod_njw, or app_preprod_bel
  2. A new private field transformation has been created with the following configuration:
    • name: app-env-datacenter
    • type: regex-based
    • Regular expression: app_(?<env>\w+)_(?<datacenter>.+)
    • Format: env::$1 datacenter::$2
    • Source key: tag::host
    • "Create multivalued fields" is not selected
    • "Automatically clean field names" is not selected

When I run a given search for my logs, however, I'm not seeing the field env or the field datacenter. 

I've also double-checked my regex and checked with a couple 

Is there some inherent misunderstanding in this setup? Is it not possible to do this against 'tag::host' as a source key?

Any and all help is appreciated!!!

~ Jen

Labels (2)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...