Splunk Search

transforms.conf and props.conf

fi5033
Engager

I am trying to extract some values from the Host field. For example, variations of host name being:
labAppdev03, labWebdev01, labDocDev02. What I am trying to get is App, Web or Doc as a role field out of host name field.

What I have so far:

transforms.conf:

[role]
SOURCE_KEY=MetaData:Host
REGEX=host::*(App|Web|Doc)*
FORMAT=role::app
WRITE_META=true

Props.conf:

[sourceone]
TRANSFORMS-role=role
0 Karma

southeringtonp
Motivator

For FORMAT, it should reference the number of the capture group in your regular expression (i.e., which set of parentheses are you looking in). You only need WRITE_META for index-time field extractions, which are usually best avoided. Similarly, you can just use host here in SOURCE_KEY, since it will be a normal field at that point. Last, for your regex - either use .* to match multiple characters, or just leave it out completely since you're already matching anywhere within the hostname.

Try:

#transforms.conf
[role]
SOURCE_KEY=host
REGEX=(App|Web|Doc)
FORMAT=role::$1

#props.conf:
[sourceone]
TRANSFORMS-role=role
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...