Getting Data In

How do I rename a DNS named host to an IP address host?

Path Finder

I have a remote host that is sending logs via a universal forwarder. The logs are arriving with a hostname of "prodsde01"

How can I change this to an IP address instead (i.e 10.201.1.10)

I tried the props/transforms config but I can't get the regex right

Here is the syslog message

Sep 26 20:33:23 prodsde01 scdpd[13592]: Alarm model 10: svSysServiceComponentOnlineNotification: Unavailable Service Component Cleared: svsde
0 Karma

Revered Legend

I would rather update the syslog configuration to update the host format to IP instead of DNS name. You can update to (not recommended, adds overhead to indexing process) an IP address during indexing using props/transforms if both host name and IP are fixed (no dnslookup is available during index time transformation.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!