topic Re: strip fqdn from hostname field in Getting Data In

strip fqdn from hostname field

hanijamal — Wed, 04 Jan 2017 03:06:46 GMT

hey guys, i am pretty sure we have something in place which is stripping the hostname from the fqdn. just cannot figure it out.

for example host=ab12345.domain.com gets stripped and when searched only shows host=ab12345

we have a few thousand hosts that are coming in fine, however a handful show up WITH fqdn when i make a search.

why would only a few hosts be showing with fqdn when 99% are showing in search fine.

background: we have a host data coming in from ucmd via lookup

thanks

Re: strip fqdn from hostname field

gokadroid — Wed, 04 Jan 2017 06:01:25 GMT

transforms.conf and props.conf might be the right place to start with and from. Please have a look here:
https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Overridedefaulthostassignments#Configuration

Re: strip fqdn from hostname field

gcusello — Wed, 04 Jan 2017 08:33:46 GMT

Hi hanijamal,
I don't know if you can intervene on your forwarders, but the hostname is setted in two conf files sited in $SPLUNK_HOME/etc/system/local:

output.conf
inputs.conf Your should verify what is the hostname you receive.

If you cannot modify hostname in your forwarders, the only way is to override hosts using props.conf and transforms.conf (see https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Overridedefaulthostassignments#Configuration):

Bye.
Giuseppe

Re: strip fqdn from hostname field

inventsekar — Wed, 04 Jan 2017 09:23:49 GMT

for logs which are not yet indexed, you can use props and transform, as mentioned above.

for the data which is already indexed, you can use regular expressions to pick only the hostnames

your search | rex field=_raw "host=(?<hostname>\w+)\." | table _raw hostname