You will have to make a dive into the world of index-time transforms.
Firstly, you have set the sourcetype to 'syslog', which it clearly isn't. This has implications, because Splunk will try to extract host information from each event. This will fail, since the events are not properly syslog-formatted. Change the sourcetype to 'my_ping_log' or something unique. Also, if possible, let the script add a date/timestamp to each event as well.
You should look at the following docs for rewriting the host value prior to indexing the events.
http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Overridedefaulthostassignments
I guess that your files should look something like;
props.conf
[my_ping_log]
TRANSFORMS-set_host = ping_script_host
transforms.conf
[ping_script_host]
REGEX = ^(\S+)\s+.*
DEST_KEY = MetaData:Host
FORMAT = host::$1
Please note that the REGEX works for the current event format, i.e. without a timestamp.
Hope this helps,
Kristian
... View more
