How to set the value of host variable

Question

I have a sql that returns rows with values MachineName, Errors

ABC 5
DEF 3

I would like value of MACHINENAME column to be assigned to the host variable.

I read this article

http://www.splunk.com/base/Documentation/latest/Admin/Overridedefaulthostassignments

but wasn't sure how to set the host variable in my particular case.

My Transforms file looks like

[xmlkv-extraction]
MV_ADD = true
REPEAT_MATCH = true
REGEX = <([^\s>])[^>]>([^<]*)\<\/\1>
FORMAT = $1::$2

and Props looks like

[ErrorMissingObject]
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE = False
LINE_BREAKER = ()
REPORT-xmlkv = xmlkv-extraction

I am wondering if I can use REPORT-xmlkv and TRANSFORM-xmlv in one file

Answer 1

host is one of the very few fields assigned at index time, so it works a little differently than most field extractions.

The link you already found is the right starting point, but maybe this will help clarify.

transforms.conf:

[override-hostname]
DEST_KEY = MetaData:Host
REGEX = ^(\S+)
FORMAT = host::$1

props.conf:

[ErrorMissingObject]
TRANSFORMS-host = override-hostname

In transforms.conf, we're telling it to match as many non-space characters as possible at the beginning of a line. Then, assign it to the hosts value. In props.conf, note that you need to use TRANSFORMS-xxx instead of REPORT-xxx, since this is happening at index time. Props.conf is what tells Splunk to actually apply the transform we defined to your data.

I'm assuming from your current props.conf that ErrorMissingObject is the sourcetype for these entries. You can just add the TRANSFORMS-host line to what's already there.

How to set the value of host variable

Follow this question

Splunk Resources

Related questions