Getting Data In

How do I alias the hostname and FQDN as the same machine?

cdyates
New Member

I'm getting events that show sources as the hosts, but Splunk is indicating that the simple hostname and the FQDN are different sources. I want Splunk to know that the simple hostname and the FQDN are the same host machine and combine events to be from one source.

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could define a transforms.conf rule like this:

[fqdn_to_hostname]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.+)\.company\.com$
DEST_KEY = MetaData:Host
FORMAT = host::$1

and apply that to all relevant hosts in props.conf like this:

[host::*.company.com]
TRANSFORMS-fqdn = fqdn_to_hostname

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could define a transforms.conf rule like this:

[fqdn_to_hostname]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.+)\.company\.com$
DEST_KEY = MetaData:Host
FORMAT = host::$1

and apply that to all relevant hosts in props.conf like this:

[host::*.company.com]
TRANSFORMS-fqdn = fqdn_to_hostname
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...