Getting Data In

Getting two different host values for same host.

jet1276
Path Finder

I am getting two separate values in host field for the same host!

Both the values are:

Hostname and hostname.

I am not sure why it is coming because I am getting logs from only one host via Splunk Universal Forwarder but still in splunk I am getting two different values for them.

0 Karma

493669
Super Champion

Hi,

You will need to create/edit the following files in $SPLUNK_HOME/etc/apps//local/:

props.conf

transforms.conf

NOTE: the following is just an example and should be modified to meet your requirements, using the relevant spec files for assistance:

props.conf:

 [yourSourceTypeHere]
 TRANSFORM-hostnametrans = hostoverride

transforms.conf:

 [hostoverride]
 REGEX = \w+\s+\d+\s+\d+\:\d+\:\d+\s+(?P<host>[^ ])
 FORMAT = host::$1
 DEST_KEY = MetaData:Host

You will need to restart Splunk to apply this change.

The following docs should be of use here...

http://docs.splunk.com/Documentation/Splunk/5.0/Data/overridedefaulthostassignments
http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf
http://docs.splunk.com/Documentation/Splunk/5.0/admin/Transformsconf
refer: https://answers.splunk.com/answers/65379/override-host-field-value-at-search-time.html

0 Karma

jet1276
Path Finder

Hi,

I am aware with the host change methods. And I am not looking for solution to the problem.

What i would like to know is that the reason behind the problem. Because the logs are being forwarded from only 1 server that is also via Universal Forwarder. Then why am I getting two different host values.

0 Karma

493669
Super Champion

is there any host keyword present in your events...which is overriding it

0 Karma

jet1276
Path Finder

No I am not overriding the data anywhere. And the installation of Universal Forwarder was also through GUI. So not overriding through any configuration files.

Also the data I am fetching are simple Windows Log Events which doesn't have other host keyword which can override the data.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...