Getting Data In

Rename host during indexing

klischatb
Path Finder

Hello everyone, 🙂

i have the following question.

In my environment i have 3 different UF where a scripted input is working with the original servername to extract some data. Thi sscript is inside one app i deployed the UF, so there is only one inputs.conf working.

What i need to do, is to rename the host name.
I Know that i can do something with the transforms.conf and props.conf, but i dont know how to do this.

example:

Original HostnameNeeded Hostname
slc4E45EMP
slc4P49PMP
slc4L47LMP

 

Maybe something like...
host = eval(case(host=slc4E45, EMP, host=slc4P49, PMP, host=slc4L47, LMP))
inside the transforms.conf.

Thank you for your help.

Labels (2)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @klischatb,

as you can read at https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Overridedefaulthostassignments you can override host value based on a regex or a value,

in your case you have to put a props.conf and a transform.conf in your indexer or (when present) on your Heavy Forwarders:

props.conf

[host::slc4E45]
TRANSFORMS-slc4E45 = override_host_slc4E45

[host::slc4P49]
TRANSFORMS-slc4E45 = override_host_slc4E45

[host::slc4L47]
TRANSFORMS-slc4E45 = override_host_slc4E45

 transforms.conf

[override_host_slc4E45]
REGEX = .
FORMAT = EMP
DEST_KEY = MetaData:Host

[override_host_slc4P49]
REGEX = .
FORMAT = PMP
DEST_KEY = MetaData:Host

[override_host_slc4L47]
REGEX = .
FORMAT = LMP
DEST_KEY = MetaData:Host

Remember to restart Splunk after conf files modifying.

Ciao.

Giuseppe

View solution in original post

klischatb
Path Finder

Thank you a lot @gcusello✔️

0 Karma

gcusello
Esteemed Legend

Hi @klischatb,

as you can read at https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Overridedefaulthostassignments you can override host value based on a regex or a value,

in your case you have to put a props.conf and a transform.conf in your indexer or (when present) on your Heavy Forwarders:

props.conf

[host::slc4E45]
TRANSFORMS-slc4E45 = override_host_slc4E45

[host::slc4P49]
TRANSFORMS-slc4E45 = override_host_slc4E45

[host::slc4L47]
TRANSFORMS-slc4E45 = override_host_slc4E45

 transforms.conf

[override_host_slc4E45]
REGEX = .
FORMAT = EMP
DEST_KEY = MetaData:Host

[override_host_slc4P49]
REGEX = .
FORMAT = PMP
DEST_KEY = MetaData:Host

[override_host_slc4L47]
REGEX = .
FORMAT = LMP
DEST_KEY = MetaData:Host

Remember to restart Splunk after conf files modifying.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...