Splunk Search

What would be the regex to map the host to my incoming data?

a212830
Champion

I want to map the host to data coming in and need help with the regex to put in transforms.conf.

The data is:

metric_name=xen.cpu0 timestamp=1420641286 value=0.0007 uuid=56fb671c-4824-a537-fbda-725547d6d980 vmname=anythinghere.abc.com

I want to map vmname to host. What would the regex be for that?

0 Karma
1 Solution

chanfoli
Builder

The following seems like a simple approach which is worth a try for the REGEX part of the stanza :

REGEX = vmname=(\S+)

of course you would also use the following for overriding the host metadata in the appropriate transforms stanza:

FORMAT = host::$1
DEST_KEY = MetaData:Host

View solution in original post

chanfoli
Builder

The following seems like a simple approach which is worth a try for the REGEX part of the stanza :

REGEX = vmname=(\S+)

of course you would also use the following for overriding the host metadata in the appropriate transforms stanza:

FORMAT = host::$1
DEST_KEY = MetaData:Host
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...