topic How do I alias the hostname and FQDN as the same machine? in Getting Data In

How do I alias the hostname and FQDN as the same machine?

cdyates — Fri, 21 Nov 2014 13:45:49 GMT

I'm getting events that show sources as the hosts, but Splunk is indicating that the simple hostname and the FQDN are different sources. I want Splunk to know that the simple hostname and the FQDN are the same host machine and combine events to be from one source.

Re: How do I alias the hostname and FQDN as the same machine?

martin_mueller — Sat, 22 Nov 2014 18:04:52 GMT

You could define a transforms.conf rule like this:

[fqdn_to_hostname]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.+)\.company\.com$
DEST_KEY = MetaData:Host
FORMAT = host::$1

and apply that to all relevant hosts in props.conf like this:

[host::*.company.com]
TRANSFORMS-fqdn = fqdn_to_hostname