I have a UF sending logs to my indexer. The UF receives logs, via syslog, from several other systems. All my UFs, indexers, and search heads are Splunk 4.2.3 and running Red Hat Linux. The logs go to a custom index, not main.
I'd like to extract the hostname from the events so I can search for host=hostname. I know the hostname is between AB: and the next colon, and believe I have the regex to do that. I believe I have to do this on the indexers.
2012-01-13 16:05:44,528 weblogic:[ExecuteThread: '20' for queue: 'webapp.queue']AB:hostname:1234567:autofoo
I've done this on a standalone implementation where the log is written to a file by syslog, but how do I do it with forwarders, multiple indexers and search heads? Right now host= the name of the UF box, not the "correct" hostnames.
You could perform an index time transform on the host field. Add entrys to props.conf and transforms.conf in the "local" directory for the app on the Universal Forwarder.My regex example is a bit generic, you might want to tighten it up a bit based on the actual patterns in your logs.
answered 13 Jan '12, 16:14