Splunk® Enterprise

Getting Data In

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Set host values based on event data

Splunk can assign host names to your events based on data in those events. This topic shows you how to use event data to override default host assignments.


To configure per-event overrides, you need to create two stanzas, one in transforms.conf and another in props.conf. Edit these files in $SPLUNK_HOME/etc/system/local/ or in your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information about configuration files in general, see "About configuration files" in the Admin manual.


Create a stanza in transforms.conf that follows this syntax:

REGEX = <your_regex>
FORMAT = host::$1
DEST_KEY = MetaData:Host

Note the following:

  • <unique_stanza_name> should reflect that it involves a host value. You'll use this name later in the props.conf stanza.
  • <your_regex> is a regular expression that identifies where in the event you want to extract the host value.
  • FORMAT = host::$1 writes the REGEX value into the host:: field.

Note: For a primer on regular expression syntax and usage, see Regular-Expressions.info. You can test regexes by using them in searches with the rex search command. Splunk also maintains a list of useful third-party tools for writing and testing regular expressions.


Next, create a stanza in props.conf that references the transforms.conf stanza:

TRANSFORMS-<class> = <unique_stanza_name>

Note the following:

  • <spec> can be:
    • <sourcetype>, the source type of an event.
    • host::<host>, where <host> is the host value for an event.
    • source::<source>, where <source> is the source value for an event.
  • <class> is any unique identifier that you want to give to your transform.
  • <unique_stanza_name> is the name of the stanza you created in transforms.conf.


Assume that you're starting with the following set of events from the houseness.log file. The host is in the third position ("fflanda", etc.).

41602046:53 accepted fflanda
41602050:29 accepted rhallen
41602052:17 accepted fflanda

First, create a new stanza in transforms.conf with a regex that extracts the host value:

DEST_KEY = MetaData:Host
REGEX = \s(\w*)$
FORMAT = host::$1

Next, reference your transforms.conf stanza in a props.conf stanza. For example:


The above stanza has the additional attribute/value pair SHOULD_LINEMERGE = false. This specifies that Splunk should break events at each newline.

The events will now appear in search results like this:

Host event.jpg

Set a default host for a file or directory input
Handle incorrectly-assigned host values

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters