Getting Data In

Assigning host value based on data in event

joshd
Builder

I'm wondering if it's possible to set the host value for an event based on data within that event. Essentially I'm capturing snmp traps to a file that is monitored by Splunk. The first line of the event looks like this:

2011-02-24 13:29:09 remote-host [UDP: [10.1.1.11]:34438]:

...Now obviously when processed by Splunk it sets the host value of each event to the default host (the local system). However I would like to set it to the value of 'remote-host' that appears on the first line of each event. Is this possible?

Thanks!

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes. This can be set at index time. In fact, if you take a look at the pre-defined "syslog" sourcetype in props.conf, you'll see rules that transform the host. The definition of the rule in transforms.conf is bit complicated because it's supposed to catch very general cases, but the principle should be the same.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Yes. This can be set at index time. In fact, if you take a look at the pre-defined "syslog" sourcetype in props.conf, you'll see rules that transform the host. The definition of the rule in transforms.conf is bit complicated because it's supposed to catch very general cases, but the principle should be the same.

0 Karma

joshd
Builder

That's perfect thanks, I dont know why I didn't even think of using a transform.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...