All Apps and Add-ons

Splunk DB Connect: How to override the default host field?

splunkrocks2014
Communicator

I have a "host" field already available from a SQL query. What is the value that needs to be put in "Set the host with this value" from Splunk DB Connect Input Service settings so that it can override the default host?

Thanks.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

I thought we added that in version 2.3 or 2.4... but I know it's there in v3. http://blogs.splunk.com/2017/02/20/splunk-db-connect-3-released/

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi splunkrocks2014, I don't think you can configure dbx 2.x to have a host value given in the data, but I expect you could use props and transforms to do this. i.e. something like:

 [mySourcetype]
 TRANSFORMS-setHost=host_override

 [host_override]
 REGEX = (regex to extract host value from event)
 DEST_KEY = MetaData:Host
 FORMAT = host::$1

Please let me know if this answers your question! 😄

0 Karma

bmacias84
Champion

I've had the same problem with DB Connect 2. The UI doesnt give you the ability to change the host key for DBX inputs. There are two methods:
1) Edit the inputs.conf directly and edit the stanza with host=yourhost (make sure to stop the service)
2) If the host value is with in the data you can use a transform to extract the host per event and replace host value. Make sure to add it to your props.conf for that source or sourcetype.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...