Getting Data In

Why are my props.conf and transforms.conf configurations to set host values based on event data being ignored?

jlamirande_splu
Splunk Employee
Splunk Employee

In the Getting Data In documentation, it says I should be able to set host based on event data using props.conf and transforms.conf:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/overridedefaulthostassignments

For the following same data:

Sep 24 13:34:18 ca693292l2/10.0.1.140 ironkey: 02280706,2015-09-24T13:34:14Z,"E:/august.txt",5,2015-08-19T11:44:11,2015-08-19T11:44:20,2015-09-24T00:00:00,5D41402ABC4B2A76B9719D911017C592

My props.conf contains:

[test_ironkey]
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
[source::.../direct-to-syslog-ng-ik_syslog-ng.txt]
TRANSFORMS-extract = ironkey1
SHOULD_LINEMERGE = false

and my transforms.conf:

[ironkey1]
DEST_KEY = MetaData:Host
REGEX = ^\w+\s\d+\s\d\d:\d\d:\d\d\s(\w+) 
FORMAT = host::$1

but when I Add Data, it seems to ignore the props.conf and transforms.conf and use the localhost?

1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

I tested this with your sample data and the following configuration works where hostname is rewritten to ca693292l2:

apply to indexers
$SPLUNK_HOME/etc/system/local/props.conf (or if using indexer clustering deploy through the cluster master which will put the configs in: $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf)

[source::.../opt/splunkforwarder/customerlogs/syslog/test.log]
TRANSFORMS-force_host = force_host

$SPLUNK_HOME/etc/system/local/transforms.conf

[force_host]
REGEX = \w+\s\d+\s\d\d:\d\d:\d\d\s(\w+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
WRITE_META = true

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

I tested this with your sample data and the following configuration works where hostname is rewritten to ca693292l2:

apply to indexers
$SPLUNK_HOME/etc/system/local/props.conf (or if using indexer clustering deploy through the cluster master which will put the configs in: $SPLUNK_HOME/etc/slave-apps/_cluster/local/props.conf)

[source::.../opt/splunkforwarder/customerlogs/syslog/test.log]
TRANSFORMS-force_host = force_host

$SPLUNK_HOME/etc/system/local/transforms.conf

[force_host]
REGEX = \w+\s\d+\s\d\d:\d\d:\d\d\s(\w+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
WRITE_META = true
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...