11:31:41 AM Steven McGrath: finally
11:31:46 AM Bossman: ???
11:31:56 AM Steven McGrath: ended up being the regex I was using was causing recursion
11:32:07 AM Bossman: glad you found it
11:32:10 AM Steven McGrath: heh
11:32:15 AM Steven McGrath: only took forever and a day
11:32:21 AM Steven McGrath: regex.... >.<
11:32:22 AM Bossman: you said it ;)
11:32:56 AM Steven McGrath: regex really is one of those things that most people should never use
11:33:02 AM Bossman: then why are you
11:33:16 AM Steven McGrath: cause it was the only way to override the host in splunk
11:33:32 AM Bossman: "host in splunk"?
11:33:54 AM Steven McGrath: yes
11:34:08 AM Steven McGrath: so you can identify the host on a per-event pasis
11:34:22 AM Bossman: i figured that, but you need regex to do that in splunk?
11:34:28 AM Steven McGrath: yes
11:34:58 AM Steven McGrath: [hostfix]
DEST_KEY = MetaData:Host
REGEX = ^\S+\s+(\S+)
FORMAT = host::$1
11:35:32 AM Bossman: why do we need that. i thought splunk was the god of parsing syslog and identifying the source host
11:35:55 AM Steven McGrath: well for some reason Snare was confusing it
11:36:09 AM Bossman: why dont the splunk guys fix there code?
11:36:18 AM Steven McGrath: it was parsing the host as feild 5, which meant that all the hosts were the event type in snare
11:36:30 AM Steven McGrath: uhm, it's not a code problem
11:36:40 AM Bossman: if there are parsing at field 5, um it is
11:37:11 AM Steven McGrath: it tried to auto-detect the field, and failed.  So I just had to override it
11:37:20 AM Bossman: see previous statement ;)