Splunk Search

How replace host using a field

tamakg
Path Finder

Hi,

I'm trying to replace the host value using a field in the data. I tried to find any previous similar solution but it's not working.

A sample of the data is here:

'##REC##;WWWDBDW;3221912927;wwwdbdw1;x52wwwdb01.domain.com;11.2.0.4.0;Linux x86 64-bit;00008481;25-Aug-16 12:00:01;25.40;0.00;0.00;0.00;964278.51;0.00;2.55;4.06;1.59'

props.conf
[www_general_stats]
TRANSFORMS-host = www_host

transforms.conf
[www_host]
SOURCE_KEY = _raw
DEST_KEY = Metadata::Host
FORMAT = host::$1
REGEX = ^(?:[^;\n]*;){4}(?P[^;]+)

Can anyone help me here, please?

Tags (1)
0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

I don't know what is "not working" (could be that it isn't finding the host properly and thus assigning something else in the field, or not assigning the host at all - you didn't really specify that). I do see two problems, one which was answered by rjthibod already and the other is the DEST_KEY. One colon instead of two:

DEST_KEY = MetaData:Host

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I don't know what is "not working" (could be that it isn't finding the host properly and thus assigning something else in the field, or not assigning the host at all - you didn't really specify that). I do see two problems, one which was answered by rjthibod already and the other is the DEST_KEY. One colon instead of two:

DEST_KEY = MetaData:Host
0 Karma

tamakg
Path Finder

The issue seems to be the upper case D of MetaData. Worked fine!

Thank you!

0 Karma

tamakg
Path Finder

AND the single colon...

0 Karma

rjthibod
Champion

You don't need the ?P part in your regex.

Use this instead: REGEX = ^(?:[^;\n]*;){4}([^;]+)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...