Splunk Search

How to create an interesting field by parsing host name

rileyken
Explorer

my index has events from many hosts. The hosts names contain information about what environment the host is part of. I would like to extract this at index time and make it an interesting field.

my host names always follow this pattern: SRV-xxP01xxxxx
the environment in this host name is "P01", and environment is always the 7th, 8th and 9th character in the host name string.

How would I go about making the environment an interesting field for my non-power users?

thanks

Tags (1)
0 Karma

dbarnesroomstog
New Member

The solution would be to apply a regex to extract the environment from the hostname. As a result the we i the props.conf you need to apply this to all host

props.conf
****************************************************************
[host::*]
TRANSFORMS-GLOBAL_environment_from_host = environment_from_host


In the transform.conf we need to specify source key for the regex as MetaData:Host , apply the regex and since this is a new field you have apply WRITE_META = true.

transform.conf
******************************************************************
[environment_from_host]
SOURCE_KEY = MetaData:Host
REGEX = "APPLY YOUR Regex HERE"
FORMAT = env::$1
WRITE_META = true


PLease be sure to apply your correct regex

0 Karma

woodcock
Esteemed Legend

Are you SURE that you need it at index-time? I will give you that answer but suspect that you would be better off by a search-time solution.
You you need this in #props.conf:

[(::){0}*]
TRANSFORMS-GLOBAL_environment_from_host = environment_from_host

Then you need this in #transforms.conf:

[environment_from_host]
SOURCE_KEY = MetaData:Host
REGEX = ^.{6}(?<environment>.{3})

If you can get by with a search-time solution, then change TRANSFORMS- to REPORT- in #props.conf and change SOURCE_KEY = MetaData:Host to SOURCE_KEY = host in #transforms.conf.

0 Karma

rileyken
Explorer

The solution provided does not work. I did some digging and found this article, which was simalar

https://www.splunk.com/blog/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf.html

maybe the issue is this bit: [(::){0}*]

0 Karma

woodcock
Esteemed Legend

This solution works. Remember you said index-time so you need to deploy it to your Indexer tiers, restart splunk on each Indexer, and then check against events that were indexed AFTER the restart. Did you do all of that?

0 Karma

dbarnesroomstog
New Member

Thats what was done and the solution didnt work.

0 Karma

adonio
Ultra Champion

try this:
... | rex field=host "SRV-\S{2}(?<Environment>\S{3})"
hope it helps

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...