Hi,
I have syslog messages coming in from thousands of servers, and I'm using splunk to index those messages. The messages are duplicated across 3 regional servers. I need the ability to show the forwarder that processed the event. How do I do that, since I change the hostname to be the network device?
You can utilize props and transforms to grab the host metadata, before it is changed and assign it to a new field. Here is an example:
# -- props.conf
[sourcetype]
TRANSFORMS-fwd_host = forwarder_host
# -- transforms.conf
[forwarder_host]
SOURCE_KEY = MetaData:Host
REGEX = host::(.*)
DEST_KEY = _meta
FORMAT = forwarder::$1
You can utilize props and transforms to grab the host metadata, before it is changed and assign it to a new field. Here is an example:
# -- props.conf
[sourcetype]
TRANSFORMS-fwd_host = forwarder_host
# -- transforms.conf
[forwarder_host]
SOURCE_KEY = MetaData:Host
REGEX = host::(.*)
DEST_KEY = _meta
FORMAT = forwarder::$1