Getting Data In

How do I alias the hostname and FQDN as the same machine?

cdyates
New Member

I'm getting events that show sources as the hosts, but Splunk is indicating that the simple hostname and the FQDN are different sources. I want Splunk to know that the simple hostname and the FQDN are the same host machine and combine events to be from one source.

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could define a transforms.conf rule like this:

[fqdn_to_hostname]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.+)\.company\.com$
DEST_KEY = MetaData:Host
FORMAT = host::$1

and apply that to all relevant hosts in props.conf like this:

[host::*.company.com]
TRANSFORMS-fqdn = fqdn_to_hostname

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could define a transforms.conf rule like this:

[fqdn_to_hostname]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.+)\.company\.com$
DEST_KEY = MetaData:Host
FORMAT = host::$1

and apply that to all relevant hosts in props.conf like this:

[host::*.company.com]
TRANSFORMS-fqdn = fqdn_to_hostname
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...