All pastes #902584 Raw Edit

Untitled

public text v1 · immutable
·published 2008-02-13 16:57 UTC
rendered paste body
/opt/splunk/etc/bundles/local/transforms.conf

[hostfix]
DEST_KEY = MetaData:Host
REGEX = ^\S+\s+(\S+)
FORMAT = host::$1

/opt/splunk/etc/bundles/local/props.conf

[source::/var/log/buffers/*]
TRANSFORMS-host=hostfix
SHOULD_LINEMERGE = false