Getting Data In

Change host at index time


I have a mixture of Wintel and *nix hosts that send logs via the UF, the UF is deployed globally by third parties so access once deployed is limited and standards vary globally in terms of hostname. All hosts start is a letter thats about it.

The question I have is that reporting is being a challenge and I want all hosts to be consistent in terms of name convention, i.e. without any fqdn name.

For Wintel and 70% of *nix this is not a problem and host appears as the shortname. However for the other 30% the fqdn name is an issue.

I've looked but can't find the answer or a solution that works.

My theory is props/transforms config on the HF's that target the sourcetype of the hosts with the fqdn.

Can someone help me out please?

As this is global and not standardized there are multiple variations on fdqn.

Goal -

Index host as shortname

Variations on fqdn could be anything along the lines -

I tried to work out a searchtime transform but couldn't get it to capture both shortname and fqdn names into one field. This would also be a valid option over the index time.



0 Karma


I would try something like this. It assumes that there are at least 2 dots in the. Restart Splunk after change. This would only be executed for all data coming from hosts that are following the pattern specified in props.conf.

props.conf on HF (one stanza for each last segment of fqdn

TRANSFORMS-fixhost = fqdn_to_short
TRANSFORMS-fixhost = fqdn_to_short
TRANSFORMS-fixhost = fqdn_to_short
..other fqdns...

transforms.conf on HF

SOURCE_KEY = MetaData:Host
REGEX = ^([A-z][^\.]+)
DEST_KEY = MetaData:Host
0 Karma


The trivial method is going to look something like this...


TRANSFORMS-FIELDS = redirect-host


REGEX = ([^.]+)\..*
DEST_KEY = MetaData:Host

That will pull everything before the first period. However, that will kill you in the occasional case where the host gets extracted as the ip address, so a more complicated regex may be needed.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...