How to rename host field value based on event data?

[Kieffer87]

I have a Linux server that ingests pre-cooked log files. Each line of the log file begins with the host that the log originated from. I have a universal forwarder on a Linux server watching for log files and I would like to rename the host field from the linux server to use the server in the event line.

On the universal forwarder I added the following but host is still ldxx90vds19. What am I missing here? I'm in a distributed environment, tried adding the same to the search heads with no luck.

inputs.conf

[batch:///app1/vdsext/elk/stats/prod/pull/serverStats.*.csv.*]
source = ldxx90vds19
sourcetype = vds:serverstats
disabled = false
index = vds
move_policy = sinkhole
initCrcLength = 1000

props.conf

[vds:serverstats]
TRANSFORMS-hostname = vdshostname

transforms.conf

[vdshostname]
REGEX = ^[a-z]\w+
FORMAT = host::$1
DEST_KEY = MetaData:Host

Sample log:

ldxx90vds2,1493923501.828,0.685,0.652,97.793,0.802,0.0,0.067,0.050,0.060,0.030,11538391040.0,410136576.0,6964232192.0,6279286784.0,1276254.500,22937.400,0.0,39.300,0.0,1823129.600

[somesoni2 · Accepted solution]

The universal forwarder doesn't do parsing of data so your props.conf and transforms.conf entries are ineffective there. Those should be kept in next Full Splunk instance, either heavy forwarder or indexer, to which your UF is sending data. A restart of Splunk would be required.

[Kieffer87]

I deployed the props.conf and transforms.conf to the indexer cluster and the host changed but it seems to just use $1 instead of the regex value.

[somesoni2]

Change the REGEX = ^[a-z]\w+ with REGEX = ^([a-z]\w+). You need to enclose the value in brackets to be recognized as $1 (first enclosed value in regex)

[Kieffer87]

That did the trick, thank you for your help.