How do I set hostname without syslog

Question

I have a UF sending logs to my indexer. The UF receives logs, via syslog, from several other systems. All my UFs, indexers, and search heads are Splunk 4.2.3 and running Red Hat Linux. The logs go to a custom index, not main.

I'd like to extract the hostname from the events so I can search for host=hostname. I know the hostname is between AB: and the next colon, and believe I have the regex to do that. I believe I have to do this on the indexers.

 2012-01-13 16:05:44,528 weblogic:[ExecuteThread: '20' for queue: 'webapp.queue']AB:hostname:1234567:autofoo

I've done this on a standalone implementation where the log is written to a file by syslog, but how do I do it with forwarders, multiple indexers and search heads? Right now host= the name of the UF box, not the "correct" hostnames.

Accepted Answer

1

You could perform an index time transform on the host field. Add entrys to props.conf and transforms.conf in the "local" directory for the app on the Universal Forwarder.My regex example is a bit generic, you might want to tighten it up a bit based on the actual patterns in your logs.

#props.conf
[my_sourcetype]
TRANSFORMS-host = my_sourcetype_host

#transforms.conf
[my_sourcetype_host]
DEST_KEY = MetaData:Host
REGEX = ^.+AB:(\w+):\d+:\w+
FORMAT = host::$1

link

answered 13 Jan '12, 16:14

Damien Dalli...
4.6k●2●3●13
accept rate: 23%

Working on getting this implemented using a Deployment Server. The regex needs some work as I have an AB: or CD: situation. (That shouldn't be a big deal.) The props.conf and transforms.conf go on the UF, huh, not on the indexer? $SPLUNK_HOME/etc/apps/jeff/local/{props.conf|transforms.conf}

(23 Jan '12, 14:17) I am Jeff

regex = ^.+(?:AB|CD):(w+):d+:w+

Yep , the files get deployed to the UF.

(23 Jan '12, 14:39) Damien Dalli...

How do I set hostname without syslog

Follow this question

Splunk Resources

Related questions