Splunk Enterprise

help on transforms.conf

jip31
Motivator

hi

i have difficulties to understandand whats exacty do the field DEST_KEY and FORMAT on my host in stanza 1 and FORMAT in stanza 2

I have read the documentation but.....

Thanks in advance

  [rfc5424_host]
  DEST_KEY = MetaData:Host
  REGEX = <\d+>\d{1}\s{1}\S+\s{1}(\S+)
  FORMAT = host::$1
[host_as_src]
SOURCE_KEY = host
REGEX = (.+)
FORMAT = src::"$1

 

Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

in 1st case DEST_KEY define that value of REGEX (inside()) will put into host field. That seems to be a host value in syslog feed, based on your REGEX.

In 2nd example, I think that you have additional “ on your stanza? Basically it take host field and copy it’s content to src field.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

in 1st case DEST_KEY define that value of REGEX (inside()) will put into host field. That seems to be a host value in syslog feed, based on your REGEX.

In 2nd example, I think that you have additional “ on your stanza? Basically it take host field and copy it’s content to src field.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...