Getting Data In

Why are my props.conf and transforms.conf configurations to set host values based on event data being ignored?

jlamirande_splu
Splunk Employee
Splunk Employee

In the Getting Data In documentation, it says I should be able to set host based on event data using props.conf and transforms.conf:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/overridedefaulthostassignments

For the following same data:

Sep 24 13:34:18 ca693292l2/10.0.1.140 ironkey: 02280706,2015-09-24T13:34:14Z,"E:/august.txt",5,2015-08-19T11:44:11,2015-08-19T11:44:20,2015-09-24T00:00:00,5D41402ABC4B2A76B9719D911017C592

My props.conf contains:

[test_ironkey]
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
[source::.../direct-to-syslog-ng-ik_syslog-ng.txt]
TRANSFORMS-extract = ironkey1
SHOULD_LINEMERGE = false

and my transforms.conf:

[ironkey1]
DEST_KEY = MetaData:Host
REGEX = ^\w+\s\d+\s\d\d:\d\d:\d\d\s(\w+) 
FORMAT = host::$1

but when I Add Data, it seems to ignore the props.conf and transforms.conf and use the localhost?

1 Solution

rphillips_splun
Splunk Employee
Splunk Employee

I tested this with your sample data and the following configuration works where hostname is rewritten to ca693292l2:

apply to indexers
$SPLUNK_HOME/etc/system/local/props.conf (or if using indexer clustering deploy through the cluster master which will put the configs in: $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf)

[source::.../opt/splunkforwarder/customerlogs/syslog/test.log]
TRANSFORMS-force_host = force_host

$SPLUNK_HOME/etc/system/local/transforms.conf

[force_host]
REGEX = \w+\s\d+\s\d\d:\d\d:\d\d\s(\w+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
WRITE_META = true

View solution in original post

rphillips_splun
Splunk Employee
Splunk Employee

I tested this with your sample data and the following configuration works where hostname is rewritten to ca693292l2:

apply to indexers
$SPLUNK_HOME/etc/system/local/props.conf (or if using indexer clustering deploy through the cluster master which will put the configs in: $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf)

[source::.../opt/splunkforwarder/customerlogs/syslog/test.log]
TRANSFORMS-force_host = force_host

$SPLUNK_HOME/etc/system/local/transforms.conf

[force_host]
REGEX = \w+\s\d+\s\d\d:\d\d:\d\d\s(\w+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
WRITE_META = true
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...