Hi All, We log data from devices belonging to different customers, they are written to our syslog server in files named /data/log/CUSTOMER/site/router1.log, for example. I wanted to have a search-time field called customer with the value CUSTOMER, taken from the source filename. I did this via the web GUI, under Settings/Fields/Field Transformation, this is what was written in $SPLUNK_HOME/etc/apps/search/local/transforms.conf: [get_customer] FORMAT = customer::$1 REGEX = \/data\/log\/(.*)\/site.* SOURCE_KEY = MetaData:Source Unfortunately nothing happens, I get no field named customer when I search. From what I can tell, the regex is correct. I also tried just "source" as SOURCE_KEY but nothing changed. Is anything wrong with my transform ? I am also not sure how this transform is applied, is it run against log messages arriving via all indexes ? As additional info, we are running splunk on a separate server (so basically the indexer) and we use a light forwarder on our syslog server. The transform above is done on the indexer. Thanks, Stefan ... View more

Hello all, I am new to Splunk and I am currently evaluating 6.1. We collect logs from a bunch of devices (routersand switches) to a central syslog server (syslog-ng) and currently splunk runs on this server. I am trying to get it to detect the hostname of the device from the log filename but I can't seem to get it to work. I went through a lot of the questions already posted here and it seems to me what I am doing should work, but it doesn't. This is the entry I have in /apps/search/local/inputs.conf: [monitor:///data/log/Core/*] blacklist = \.(gz|bz2|z|zip|\d)$ disabled = false followTail = 0 host = whitelist = \.cnt.int.log$ host_regex = ^/data/log/Core/(.*)\.cnt\.int\.log$ sourcetype = cisco:ios (this was added by the web gui) The files look like this: /data/log/Core/router1.cnt.int.log /data/log/Core/router2.cnt.int.log /data/log/Core/router3.cnt.int.log /data/log/Core/router4.cnt.int.log /data/log/Core/router4.cnt.int.log.1 /data/log/Core/router4.cnt.int.log.2.gz /data/log/Core/router4.cnt.int.log.3.gz /data/log/Core/router5.cnt.int.log /data/log/Core/router6.cnt.int.log /data/log/Core/router7.cnt.int.log The regex looks fine to me, it checks out ok in RegExr. Despite all this, when I go to the Web gui, search and click on Data summary, I only see the syslog server hostname. There is none of those router1, router2 and so on hostnames which I expected to see. Any idea why this is not working ? Regards, Stefan ... View more