Hi All, Currently we have request to change only the host from test01 to test02 for a sourcetype=sap:script:error and source=///export/home/ct/script/jobtrigger/.log*.
We have customized app for monitoring this log and it is mapped to the host = test01. In serverclass.conf , test01 is present in the include (whitelist) and by changing the client from test01 to test02 custom app will be pointed to new host test02.
Both in test01 and test02 splunk agent is running.
So by doing the above step will it fix the issue? Got a doubt so posted it before doing the changes in Prod.
thanks in advance.
If you want to use the same app everywhere :
create a props.conf that will call a transforms for your sourcteype
them create a transforms.conf that will replace the host under certain regex matching condition, and will rename test01 to test02 in my example
# props.conf
[sap:script:error]
TRANSFORMS-change-host=renamehost_test
#transforms.conf to change Host
[renamehost_test]
SOURCE_KEY = MetaData:Host
REGEX = (test01)
DEST_KEY = MetaData:Host
FORMAT = sourcetype::test02
Deploy the rules on the the indexers or first heavy forwarders (if you have any)
Hi Yannk, thanks for your effort on this, I had changed the host=test01 to test02 by changing the host name from the serverclass.conf , i had removed the old hostname and added the new hostname. Actually client wants to remove the app from the old node and want to point to the new node.
it resolved the issue. thanks for your support on this.