hey guys, i am pretty sure we have something in place which is stripping the hostname from the fqdn. just cannot figure it out.
for example host=ab12345.domain.com gets stripped and when searched only shows host=ab12345
we have a few thousand hosts that are coming in fine, however a handful show up WITH fqdn when i make a search.
why would only a few hosts be showing with fqdn when 99% are showing in search fine.
background: we have a host data coming in from ucmd via lookup
transforms.conf and props.conf might be the right place to start with and from. Please have a look here:
I don't know if you can intervene on your forwarders, but the hostname is setted in two conf files sited in $SPLUNK_HOME/etc/system/local:
If you cannot modify hostname in your forwarders, the only way is to override hosts using props.conf and transforms.conf (see https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Overridedefaulthostassignments#Configuration...
for logs which are not yet indexed, you can use props and transform, as mentioned above.
for the data which is already indexed, you can use regular expressions to pick only the hostnames
your search | rex field=_raw "host=(?<hostname>\w+)\." | table _raw hostname