Documentation:
3.0.2
This page last updated: 11/20/07 04:11pm
Extract host per event
Use these instructions if you want to override the default host name that is assigned to your events.
ConfigurationYou can explicitly configure the host name of any source or sourcetype via transforms.conf and props.conf.
transforms.confAdd your custom stanza to $SPLUNK_HOME/etc/bundles/local/transforms.conf. You should configure your stanza as follows:
[$UNIQUE_STANZA_NAME] DEST_KEY = MetaData:Host REGEX = $YOUR_REGEX FORMAT = host::$1
Fill in the stanza name and the regex fields with the correct values for your data.
Leave DEST_KEY = MetaData:Host to write a value to the host:: field. FORMAT = host::$1 writes the REGEX value into the host:: field.
Please note: You will need to name your stanza with a unique identifier (so it is not confused with a stanza in $SPLUNK_HOME/etc/bundles/default/transforms.conf).
props.confYou will also need to create a stanza in $SPLUNK_HOME/etc/bundles/local/props.conf to map the transforms.conf regex to the source type in props.conf.
[<spec>] TRANSFORMS-$name=$UNIQUE_STANZA_NAME
<spec> can be:
1. <sourcetype>, the sourcetype of an event
2. host::<host>, where <host> is the host for an event
3. source::<source>, where <source> is the source for an event
$name is whatever unique identifier you want to give to your transform.
$UNIQUE_STANZA_NAME must match the stanza name of the transform you just created in transforms.conf.
Please note: you can add any valid attribute/value pairs from props.conf when defining your stanza. This will assign the attributes for the <spec> you have set.
ExampleThe following logs contain the host in the third position.
41602046:53 accepted pearl 41602050:29 accepted swan 41602052:17 accepted pearl
Create a regex to extract the host value and add it to a new stanza in $SPLUNK_HOME/etc/bundles/local/transforms.conf:
[station] DEST_KEY = MetaData:Host REGEX = \s(\w*)$ FORMAT = host::$1
Now, link your transforms.conf stanza to $SPLUNK_HOME/etc/bundles/local/props.conf so your transforms are called. For example, the above transform works with the following stanza in props.conf:
[source::.../hatch.log] TRANSFORMS-dharma=station SHOULD_LINEMERGE = false
The above stanza has the additional attribute/value pair SHOULD_LINEMERGE = false. This specifies that Splunk should create new events at a newline.
Please note: you can add any additional attribute/value pairs from props.conf as needed.
The events now appear in SplunkWeb as the following:
Comments
No comments have been submitted.