Reporting

How to set the value of host variable

danurag
Explorer

I have a sql that returns rows with values MachineName, Errors

ABC 5
DEF 3

I would like value of MACHINENAME column to be assigned to the host variable.

I read this article

http://www.splunk.com/base/Documentation/latest/Admin/Overridedefaulthostassignments

but wasn't sure how to set the host variable in my particular case.

My Transforms file looks like

[xmlkv-extraction]
MV_ADD = true
REPEAT_MATCH = true
REGEX = <([^\s>])[^>]>([^<]*)\<\/\1>
FORMAT = $1::$2

and Props looks like

[ErrorMissingObject]
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = False
LINE_BREAKER = ()
REPORT-xmlkv = xmlkv-extraction

I am wondering if I can use REPORT-xmlkv and TRANSFORM-xmlv in one file

Tags (2)
0 Karma

southeringtonp
Motivator

host is one of the very few fields assigned at index time, so it works a little differently than most field extractions.

The link you already found is the right starting point, but maybe this will help clarify.

transforms.conf:

[override-hostname]
DEST_KEY = MetaData:Host
REGEX = ^(\S+)
FORMAT = host::$1

props.conf:

[ErrorMissingObject]
TRANSFORMS-host = override-hostname

In transforms.conf, we're telling it to match as many non-space characters as possible at the beginning of a line. Then, assign it to the hosts value. In props.conf, note that you need to use TRANSFORMS-xxx instead of REPORT-xxx, since this is happening at index time. Props.conf is what tells Splunk to actually apply the transform we defined to your data.

I'm assuming from your current props.conf that ErrorMissingObject is the sourcetype for these entries. You can just add the TRANSFORMS-host line to what's already there.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...