Archive
Highlighted

strip fqdn from hostname field

New Member

hey guys, i am pretty sure we have something in place which is stripping the hostname from the fqdn. just cannot figure it out.

for example host=ab12345.domain.com gets stripped and when searched only shows host=ab12345

we have a few thousand hosts that are coming in fine, however a handful show up WITH fqdn when i make a search.

why would only a few hosts be showing with fqdn when 99% are showing in search fine.

background: we have a host data coming in from ucmd via lookup

thanks

Tags (1)
0 Karma
Highlighted

Re: strip fqdn from hostname field

Motivator

transforms.conf and props.conf might be the right place to start with and from. Please have a look here:
https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Overridedefaulthostassignments#Configuration

0 Karma
Highlighted

Re: strip fqdn from hostname field

Legend

Hi hanijamal,
I don't know if you can intervene on your forwarders, but the hostname is setted in two conf files sited in $SPLUNK_HOME/etc/system/local:

  • output.conf
  • inputs.conf Your should verify what is the hostname you receive.

If you cannot modify hostname in your forwarders, the only way is to override hosts using props.conf and transforms.conf (see https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Overridedefaulthostassignments#Configuration...

Bye.
Giuseppe

View solution in original post

0 Karma
Highlighted

Re: strip fqdn from hostname field

Champion

for logs which are not yet indexed, you can use props and transform, as mentioned above.

for the data which is already indexed, you can use regular expressions to pick only the hostnames

your search | rex field=_raw "host=(?<hostname>\w+)\." | table _raw hostname
0 Karma