All Apps and Add-ons

Splunk DB Connect: How to override the default host field?


I have a "host" field already available from a SQL query. What is the value that needs to be put in "Set the host with this value" from Splunk DB Connect Input Service settings so that it can override the default host?


0 Karma

Splunk Employee
Splunk Employee

I thought we added that in version 2.3 or 2.4... but I know it's there in v3.

0 Karma


Hi splunkrocks2014, I don't think you can configure dbx 2.x to have a host value given in the data, but I expect you could use props and transforms to do this. i.e. something like:


 REGEX = (regex to extract host value from event)
 DEST_KEY = MetaData:Host
 FORMAT = host::$1

Please let me know if this answers your question! 😄

0 Karma


I've had the same problem with DB Connect 2. The UI doesnt give you the ability to change the host key for DBX inputs. There are two methods:
1) Edit the inputs.conf directly and edit the stanza with host=yourhost (make sure to stop the service)
2) If the host value is with in the data you can use a transform to extract the host per event and replace host value. Make sure to add it to your props.conf for that source or sourcetype.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...