How do I alias the hostname and FQDN as the same machine?

[cdyates]

I'm getting events that show sources as the hosts, but Splunk is indicating that the simple hostname and the FQDN are different sources. I want Splunk to know that the simple hostname and the FQDN are the same host machine and combine events to be from one source.

[martin_mueller · Accepted solution]

You could define a transforms.conf rule like this:

[fqdn_to_hostname]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.+)\.company\.com$
DEST_KEY = MetaData:Host
FORMAT = host::$1

and apply that to all relevant hosts in props.conf like this:

[host::*.company.com]
TRANSFORMS-fqdn = fqdn_to_hostname