Getting Data In

How do I alias the hostname and FQDN as the same machine?

cdyates
New Member

I'm getting events that show sources as the hosts, but Splunk is indicating that the simple hostname and the FQDN are different sources. I want Splunk to know that the simple hostname and the FQDN are the same host machine and combine events to be from one source.

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could define a transforms.conf rule like this:

[fqdn_to_hostname]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.+)\.company\.com$
DEST_KEY = MetaData:Host
FORMAT = host::$1

and apply that to all relevant hosts in props.conf like this:

[host::*.company.com]
TRANSFORMS-fqdn = fqdn_to_hostname

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could define a transforms.conf rule like this:

[fqdn_to_hostname]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.+)\.company\.com$
DEST_KEY = MetaData:Host
FORMAT = host::$1

and apply that to all relevant hosts in props.conf like this:

[host::*.company.com]
TRANSFORMS-fqdn = fqdn_to_hostname
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...