Getting Data In

What is the easiest way to search-time transform for hostname and FQDN?

Path Finder

I have historical data in Splunk where the same host may appear as either Hostname.Domain.Com or Hostname. I would like all searches that specify Hostname to also gather events for Hostname.Domain.Com without modifying any searches. I can't delete and reindex, so that's right out.

I found this post , which seems to be more or less what I want to do, but it isn't working, and I'm not sure why. It's older, so maybe the settings need to be different. 

What is the easiest way to accomplish this goal? Cheers.

Labels (4)
0 Karma

Ultra Champion

Transforms are applied at index time.  The solution you're pointing to is rewriting the host value when splunk is ingesting events. It shortens them host field for * before indexing themevents. With such setup all applicable events would have short names. But only the newly indexed ones of course.

As I understand your indexed field host for some of your already indexed events contains host=host1 and for some

And you would like to match events with to match if a user searches for just host=host1?

That's a tough one. There is a solution but it's very ugly and I wouldn't do that if I were you - fiddling with default fields can have unforseeable results.

But anyway.

Since you want the host field to match both hostname as well as fqdn, you need to make the field multivalued in search time. To do this you have to define a calculated field named host for your sourcetype (or host) with formula


Hopelessly ugly hack but seems to work on my lab.

Path Finder

Thank you for the detailed explanation. I'll try this in test and see how it works with my dataset.


I suppose it isn't the end of the world if only newly indexed events have the short name, but I know my security folks will hate that answer. It'll be irritating to go back and edit every dashboard panel deployment-wide to accommodate the two-name dichotomy for historical searches.

Tags (1)
0 Karma

Ultra Champion

It seems I ate one closing parenthesis ;). But you probably spotted that while testing.

Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...