I have a centralized syslog server which I forward all other server logs to. All of those logs are combined per log type such as /var/log/messages, /var/log/secure, etc. I've setup my transforms.conf file to take the hostname out of each line and assign it as the host per log file line. I've associated the transform to the various logs. After restarting the splunk forwarder I'm still not seeing my logs being broken out by host. I'm wondering if it's because of the host value in inputs.conf and if that's overriding the dynamic host value I'm creating via props and transforms. Here is what I have so far:
etc/apps/search/local/transforms.conf
[hostname]
DEST_KEY = MetaData:Host
REGEX = (?:\S+ ){2}(\S+)
FORMAT = host::$1
etc/system/local/props.conf
[source::.../messages]
TRANSFORMS-bg = hostname
SHOULD_LINEMERGE = False
Example from *splunk show config inputs*
[monitor:///var/log/messages*]
_rcvbuf=1572864
disabled=false
host=[splunk_forwarder_hostname]
index=[index_name]
sourcetype=[source_type]
My concern is the host= attribute associated with every monitor entry. Is this the source of my issues or do I need to be looking somewhere else?
Bert
↧