Getting Data In

tranforms file to change hosts for syslog not working

nitin_mehta
New Member

Hi,
Note: I am using Splunk Universal forwarder
We are forwarding logs form our central syslog server to a new splunk server.
In the universal forwarder I am trying to put in a transform to change the host field to the machine that has sent the syslog logs to the central sylog server.

All the syslog records have s_local@hostname in the record so I want to extract this hostname field. The logs files themselves are under the path /var/log/HOSTS/ on the central syslog server. The problem is that only the syslog server shows up in the host field on the splunk server(syslog server name=hds1prd)

The files on the forwader are:

-inputs.conf

[monitor:///var/log/HOSTS/...]

disabled = 0

followTail = 0

sourcetype = syslog

whitelist = 2012

-props.conf

[ syslog ]

TRANSFORMS-t1 = rename_host

-transforms.conf

[rename_host]

REGEX = s_local@([^\s]+)

FORMAT = host::$1

DEST_KEY = MetaData:Host

Any help will be much appreciated,

Tags (1)
0 Karma

Ayn
Legend

The main reason for that this isn't working is that you're applying these settings on your forwarder. Forwarders do not perform any parsing of data, so they cannot perform any filtering. These settings should go on your indexer instead.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...