Getting Data In

Kiwi and Splunk

ihoffmann_wth
New Member

Hi guys,

I've tried several transformations and even field extractor but I can't get Splunk to extract the hostname out of Kiwi's syslog files.

I have created the following transformation: (?i)^[^.]*.\w+\t(?P[^\t]+) using the field extractor but even after nuking the index I can't get it to extract the hostname/IP out of my .txt syslog files, we have 1 for each device rotated once a day.

I even created a new sourcetype with no luck.

Any ideas would be appreciated.

Thank you

Tags (2)
0 Karma

Damien_Dallimor
Ultra Champion

Being a New Zealander , I feel compelled to answer 🙂

For the "host" field , you might want to consider performing an index time transform (via entrys in props.conf and transforms.conf)

props.conf

[kiwisourcetype]
TRANSFORMS-host=extract-kiwi-host

transforms.conf

[extract-kiwi-host]
DEST_KEY = MetaData:Host
REGEX = (?i)^[^.]*.w+t([^t]+)
FORMAT = host::$1

Can you also post an example from the syslog file so I can check the accuracy of your regex ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...