Hostname swap

[fzyqkl]

Before I got my server named properly for splunk I received a lot of records under the hostname 'localhost:localdomain'. I am no longer receiving data from this hostname since I got the hostname changed. Is there any way to change the hostname in the records from 'localhost:localdomain' to 'myserver' so I can get rid of 'localhost:localdomain' from the Hosts list and retain the data??

[jbsplunk]

You can't alter the metadata once it has been written, so any data associated with the metadata for host localhost:localdomain is going to be associated with that permanently within the index where the data exists. You could do search time field extractions to look for the host field matching that criteria and change it into 'myserver' when a match is found. A good example of this was used in another Answers post:

http://splunk-base.splunk.com/answers/27123/host-name-extraction-from-syslog-repository