Getting Data In

How to change host with props.conf and transforms.conf

ilhwan
Explorer

I have an add-on running on a heavy forwarder that is using the name of the HF as the  host.  I'm trying to change the host to something  more useful.  All of the events are of the sourcetype rubrik:*.

Here is a sample event:

{"_time": "2022-03-07T23:31:00.000Z", "clusterName": "my-host", "locationId": "XXXmaskedXXX", "locationName": "XXXmaskedXXX", "type": "Outgoing", "value": 0}

I would like to use "my-host" as the host.  This is what I'm trying with no success.

props.conf:

[rubrik:*]
TRANSFORMS-myhost = hostoverride

transforms.conf:

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = \"clusterName\"\:\s\"(.+)\".+
FORMAT = host::$1

 

Labels (4)
0 Karma
1 Solution

ilhwan
Explorer

I got it to work.  The problem was props.conf.  I had to not use a wildcard in the sourcetype.

This is what is working for me.

props.conf:

[rubrik:archivebandwidth]
TRANSFORMS-hostoverride = hostoverride

[rubrik:archiveusage]
TRANSFORMS-hostoverride = hostoverride

[rubrik:clusteriostats]
TRANSFORMS-hostoverride = hostoverride

[rubrik:eventfeed]
TRANSFORMS-hostoverride = hostoverride

[rubrik:mvsummary]
TRANSFORMS-hostoverride = hostoverride

[rubrik:nodeiostats]
TRANSFORMS-hostoverride = hostoverride

[rubrik:nodestats]
TRANSFORMS-hostoverride = hostoverride

[rubrik:orgcapacityreport]
TRANSFORMS-hostoverride = hostoverride

[rubrik:runwayremaining]
TRANSFORMS-hostoverride = hostoverride

[rubrik:storagesummary]
TRANSFORMS-hostoverride = hostoverride

transforms.conf:

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = \"clusterName\":\s\"([a-zA-Z-_]+)\"
FORMAT = host::$1

View solution in original post

0 Karma

gcusello
Legend

Hi @ilhwan,

only one question: where do you located props and transforms?

In your case they must located in the Heavy Forwarder.

Ciao.

Giuseppe

0 Karma

ilhwan
Explorer

Yes, it's on the HF that has the add-on.  It's in the local directory.

0 Karma

gcusello
Legend

Hi @ilhwan,

the regex you used in transforms.conf isn't correct, please try 

\"clusterName\"\:\s\"([^\"]+)\".+

that you can test at https://regex101.com/r/Tt1gyI/1

Ciao.

Giuseppe

0 Karma

ilhwan
Explorer

That captures the entire rest of the line instead of just the field I'm interested in.  This is what I'm trying now:

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = \"clusterName\":\s\"([a-zA-Z-_]+)\"
FORMAT = host::$1

0 Karma

ilhwan
Explorer

I got it to work.  The problem was props.conf.  I had to not use a wildcard in the sourcetype.

This is what is working for me.

props.conf:

[rubrik:archivebandwidth]
TRANSFORMS-hostoverride = hostoverride

[rubrik:archiveusage]
TRANSFORMS-hostoverride = hostoverride

[rubrik:clusteriostats]
TRANSFORMS-hostoverride = hostoverride

[rubrik:eventfeed]
TRANSFORMS-hostoverride = hostoverride

[rubrik:mvsummary]
TRANSFORMS-hostoverride = hostoverride

[rubrik:nodeiostats]
TRANSFORMS-hostoverride = hostoverride

[rubrik:nodestats]
TRANSFORMS-hostoverride = hostoverride

[rubrik:orgcapacityreport]
TRANSFORMS-hostoverride = hostoverride

[rubrik:runwayremaining]
TRANSFORMS-hostoverride = hostoverride

[rubrik:storagesummary]
TRANSFORMS-hostoverride = hostoverride

transforms.conf:

[hostoverride]
DEST_KEY = MetaData:Host
REGEX = \"clusterName\":\s\"([a-zA-Z-_]+)\"
FORMAT = host::$1

0 Karma

gcusello
Legend

Hi @ilhwan,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...