All Apps and Add-ons

In the Splunk Add-on for Unix and Linux, can you help me with a Splunk_TA_nix Issue with transform?

bgagliardi1
Path Finder

The TA is overriding my Host Segment in my monitor file. Is there a purpose for this?

Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-001
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-002
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-003
Splunk_TA_nix/default/transforms.conf:FORMAT = host::ACME-004

props.conf-###### Global ######
props.conf-[source::...(linux.*|sample.*.linux)]
props.conf:TRANSFORMS-force_host_for_linux_eventgen = force_host_for_linux_eventgen
0 Karma

sloshburch
Splunk Employee
Splunk Employee

It appears you've run into some configuration used specifically by eventgen. Eventgen is used to demo or get a sense of an addon without having to collect real data.

Specifically, it looks like you happen to be collecting a source that follows the file name pattern (linux.*|sample.*.linux).

This could be as simple as making sure your filename does not match that pattern.
Alternatively, you could add a props.conf to the local folder of the TA that unsets that configuration. Maybe something like:

[source::...(linux.*|sample.*.linux)]
TRANSFORMS-force_host_for_linux_eventgen = 

I haven't tested but in my mind that should unset that attribute and provide safety with upgrades of the TA.

Feel free to share the name of the file if it helps in the discussion.

raytrotter_exp
Engager

Ran into this issue with data coming from another Splunk environment. This answer fixed the issue.

0 Karma

bgagliardi1
Path Finder

I deleted that part of the config file as a resolution.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

But remember that it will return every time you upgrade/update the app since it's part of the default folder's configuration (right?).

Unsetting it in the local will persist through upgrades.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...