I have added this to $local/props.conf and $local/transforms.conf, respectively:
And some sample output from the file I'm using as a data input is:
I've deleted the data input and re-added it, I've also restarted splunk.
So from the example above, I'm trying to set the host to 10.219.49.51. Problem is that it doesn't seem to be using the host from the regex in props.conf to populate the host field when I realtime search for matches since the restart.
Can anyone see anything that I've missed?
I think the following line in your props:
TRANSFORMS = snmp-trap-host
should be something like this: TRANSFORMS-name. Try the one below:
TRANSFORMS-trap_host = snmp-trap-host
answered 10 Oct '11, 15:09
Pretty sure the problem is in the REGEX attribute in the [snmp-trap-host] stanza. You defined the group as a non-capturing group, which means the $1 group in the FORMAT attribute will always be blank. Furthermore, even if you remove the "?:" from the regex statement, I still don't think the group will capture the entire IP address. I recommend updating your regex code and re-testing it using an online regex testing tool. I really like this site: http://www.myezapp.com/apps/dev/regexp/show.ws
answered 31 Jul '12, 10:46