topic Re: incorrect host names in Getting Data In

incorrect host names

lain179 — Wed, 10 Apr 2013 18:44:39 GMT

I extracted the host names wrong, and now I have extra names in my Splunk. Example: Server01 vs. Server1 and Server02 vs. Server2, etc.

What's the best way to fix this so I only have Server01, Server02, etc.? Delete? Rename? Any suggestions?

Thanks!

Re: incorrect host names

kristian_kolb — Wed, 10 Apr 2013 20:36:02 GMT

You cannot rename the host field, once it's been indexed. However, you can dynamically change it as part of the search for the duration of that search. (say you indexed server1.domain.com, buy you just wanted the server1)

... | rex field=host "(?<host>[^.]+)" | ...

Not really neat. Will probably have effects on drill-downs etc, where the new host field value won't match indexed data....Other than that, wait until the data ages out of your index.. or delete and re-index.

Re: incorrect host names

stefandagerman — Wed, 10 Apr 2013 20:37:13 GMT

If you don't want to or cannot reindex your data, I would probably use tags or create a new field with an appropriate RegEx that normalizes your server names. You'd then use the tag or new field name in your searches rather than the original server name.

Re: incorrect host names

stefandagerman — Wed, 10 Apr 2013 20:38:53 GMT

Note that that new field won't be indexed like the 'host' field is.

Re: incorrect host names

lain179 — Wed, 10 Apr 2013 23:55:02 GMT

I don't need those logs with wrong host names as I re-import the data with correct host names. So can I just delete them? Is there a way to selectively delete indexed data?

Re: incorrect host names

stefandagerman — Thu, 11 Apr 2013 00:17:09 GMT

Yes you can, with a userid that has can_delete privilege (admin does not have that by default).
Construct a search that returns all events you want deleted, make sure the result is what you expect and add "| delete" once you are sure.
Note that events will not be deleted physically, so if you want to reclaim the disk space immediately, I think you would have to delete and recreate the index and re-index everything.

Re: incorrect host names

lain179 — Fri, 12 Apr 2013 22:15:32 GMT

Ok, thanks!