topic Re: How is this field generated... in Splunk Search

How is this field generated...

SplunkFu — Tue, 21 May 2013 13:53:56 GMT

... "src_hostname"?

The reason I ask, is that I can not seem to find it, and it is generating "odd" results in a search someone set up for us an age ago.

Thanks,

Matt

Re: How is this field generated...

cramasta — Tue, 21 May 2013 14:04:20 GMT

I dont think that is a Splunk default field. On the search head go to the manager and then to fields > field extractions and then search for src_hostname (make sure you set the app context pulldown menu and the user pulldown to All). that should list the regex that is being used to generate that field.

Re: How is this field generated...

jkat54 — Tue, 21 May 2013 14:25:28 GMT

In case you're calling it a field but it is actually a sourcetype , you'll have to check the inputs.conf files you have deployed.

If it is indeed a field, the answer from cramasta below is acceptable.

Re: How is this field generated...

SplunkFu — Tue, 21 May 2013 15:47:10 GMT

Stupid mistake on my behalf... it was a really long search, at the end of a really long day, and missed the lookup.

HAHAHAHAHHAHAHAH