Be sure your syntax conforms with this example.
The transforms.conf stanza would look something like this:
[force_the_host]
REGEX = ^\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s\"([^\"]+)\"
FORMAT = host::$1
DEST_KEY = MetaData:Host
**Note the capturing group, just after the double quote says "anything that is not a double quote".
in props.conf you would have:
TRANSFORMS-force_host=force_the_host
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
