Single host is showing up as multiple sources (i.e. server1 and ip-server1). How can I clean this up?

[jgilligan1985]

Greetings,

In splunk search, some of the hosts are showing under multiple host names. I would like to combine the hostnames into one hostname for cleanup purposes. I fixed the initial reporting issue, but cannot seem to figure out how to make the logs show up under 1 host.

Example: server1 and ip-server1 are the same host, but show as 2 sources. I would like both sources show as server1.

[cpetterborg]

Do you have rules in your props and transforms config files that are setting the host values, and thus making different host names in your data?

[jgilligan1985]

I'm working with a relatively unconfigured install. I have a rule that makes the FQDN related back to the host name. I'm not sure how to make the host names that are generated by Amazon Web Services relate to a host name that is very different.

I'm just looking to clean up the host list under Search and Reporting and merge the data from the old host names to the correct new host name so I'm not seeing 20 host names instead of the 10 that should be there.

[cpetterborg]

Are the events coming from different sources (i.e. some from syslog and some from UF)?

[jgilligan1985]

(Forgive me, I'm just the clean up person on this.)

It looks like some of them are coming from /var/log/messages and the rest are combined under the other hostname from the rest of the logs (syslogd, audit, secure, etc) .

Also, some of the original logs are migrated over from a syslogd server. So there is an issue where plunk sees the old logs as the host name from them and then the FQDN from the new ones.