Splunk Dev

Dealing with hostnames difference and Lookups in Splunk

jmcclure
Explorer

I have an issue where my hostnames coming in (mostly from Windows) are full domain name and some are the alias

hostname vs hostname.domain.com

I have lookups that I need to have just the alias. How can I get Splunk to give me just the alias.

Am I going to have to go through the Windows TA and fix all the regexes?

Tags (1)
0 Karma

aholzer
Motivator

There's a couple of things you can do:

1) At search time you can add the following (assuming it's your host field that contains the fully qualified domain name):

<base_search>
| rex field=host "^(?P<hostname>[^\.]+)" 
| eval hostname=lower(hostname)

Then you can use the new field "hostname" to do your check against your lookup.

2) Otherwise you can define a "calculated field" to extract the value out of the fully qualified domain name field:

   lower(mvindex(split(host,"."),0))

This assumes that your FQDN is stored under field 'host', and it will grab everything up to the first period as the value for whatever field you define.

Hope this helps

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...